Polymarket Whale Scanner Trader

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:35 PM UTC
• Version:
  1.0.1

Overview

This appears to be a disclosed trading-bot skill with real financial risk, but its network and API-key use fits its stated purpose.

Install only if you intentionally want an agent-assisted trading workflow. Use paper mode first, use exchange API keys with the smallest possible scopes, avoid withdrawal permissions, set strict position and drawdown limits, and require manual confirmation before any live trade.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes use of environment variables and outbound network access, but the skill has no declared permissions to match those capabilities. This creates a trust and review gap: operators may approve or install the skill without realizing it can access credentials and contact external services, which increases the risk of secret exposure, unexpected data egress, or unauthorized live-trading actions if the implementation exceeds expectations.

VirusTotal

65/65 vendors flagged this skill as clean.