Polymarket Whale Exit Fade Trader

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.1

Overview

This is a disclosed Polymarket trading skill that scans public whale activity and defaults to simulated trades unless the user explicitly enables live trading.

Install only if you are comfortable with a trading skill that can use your SIMMER_API_KEY. Keep it in paper mode first, review the position limits and thresholds, and understand that running with --live can place real Polymarket trades and cause financial loss.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation indicates use of environment variables (`SIMMER_API_KEY`) and outbound network access to public APIs, yet no permissions are declared. This creates a trust and sandboxing gap: a platform or reviewer may underestimate the skill's access needs, and if executed in an agent framework, the skill could read secrets from the environment and communicate externally without explicit user awareness.

VirusTotal

66/66 vendors flagged this skill as clean.