Polymarket Copy Consensus Trader

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.1

Overview

This skill is a disclosed trading bot that defaults to paper trading and only places real trades when explicitly run in live mode.

Use paper mode first. Provide SIMMER_API_KEY only if you are comfortable giving this skill trading authority, review the simmer-sdk dependency before live use, keep position limits conservative, and pass --live only when you intend real USDC trades.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill description indicates it uses outbound network access to fetch leaderboard and market data and reads environment variables such as SIMMER_API_KEY, yet no explicit permissions are declared. In a trading skill, undeclared env and network capabilities are security-relevant because they obscure the skill’s effective trust boundary and can enable secret access or data exfiltration without clear operator consent.

VirusTotal

64/64 vendors flagged this skill as clean.