Polymarket Celebrity Social Trader

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:21 PM UTC
• Version:
  0.0.3

Overview

This is a disclosed Polymarket trading skill that defaults to paper trading and only performs real trades when live mode is explicitly enabled.

Install only if you intend to run a prediction-market trading bot. Start in paper mode, review candidate markets before using --live, keep position limits low, protect SIMMER_API_KEY, and consider narrowing the keyword list if you want tighter live-trading scope.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The keyword list is very broad and includes common terms like `tweet`, `viral`, `celebrity`, `relationship`, and `social media`, which can match many unrelated markets or prompts. In an automated trading context, this increases the chance of erroneous market discovery and unintended trades, especially because the skill is designed to act on discovered opportunities in a noisy domain.

VirusTotal

66/66 vendors flagged this skill as clean.