Security audit

Polymarket 24h Geopolitics Cluster Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed automated trading skill, but its implementation can undermine paper-mode and risk-limit expectations for real-money trading.

Review before installing, especially for any live use. Treat the API key as real-money trading authority, avoid running live and paper modes in the same long-lived process, and do not rely on the advertised open-position or volume limits unless the implementation is fixed or enforced server-side.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:52
Finding: Cached live trading client can bypass subsequent paper-mode requests
Content: View full analysis
SimmerClient: global _client, MAX_POSITION, MIN_VOLUME, MAX_SPREAD, MIN_DAYS, MAX_POSITIONS global YES_THRESHOLD, NO_THRESHOLD, MIN_TRADE, MIN_VIOLATION if _client is None: venue = "polymarket" if live else "sim" _client = SimmerClient( api_key=os.environ["SIMMER_API_KEY"], venue=venue, ) if live: _client.live = True try: _client.apply_skill_config(SKILL_SLUG) except AttributeError: pass # apply_skill_config only available in Simmer runtime MAX_POSITION = float(os.environ.get("SIMMER_MAX_POSITION", str(MAX_POSITION))) MIN_VOLUME = float(os.environ.get("SIMMER_MIN_VOLUME", str(MIN_VOLUME))) MAX_SPREAD = float(os.environ.get("SIMMER_MAX_SPREAD", str(MAX_SPREAD))) MIN_DAYS = int(os.environ.get( "SIMMER_MIN_DAYS", str(MIN_DAYS))) MAX_POSITIONS = int(os.environ.get( "SIMMER_MAX_POSITIONS", str(MAX_POSITIONS))) YES_THRESHOLD = float(os.environ.get("SIMMER_YES_THRESHOLD", str(YES_THRESHOLD))) NO_THRESHOLD = float(os.environ.get("SIMMER_NO_THRESHOLD", str(NO_THRESHOLD))) MIN_TRADE = float(os.environ.get("SIMMER_MIN_TRADE", str(MIN_TRADE))) MIN_VIOLATION = float(os.environ.get("SIMMER_MIN_VIOLATION", str(MIN_VIOLATION))) return _client ``` ### Technical Analysis The module stores a single `SimmerClient` in the global `_client` variable. The requested `live` mode is used only when that client is first created. Later calls return the existing client without confirming that its venue and live-trading state match the new request. If a long-lived Python process first i ...[truncated 1506 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:551
Finding: Position limit counts only orders placed during the current run
Content: View full analysis
= MAX_POSITIONS: break market, side_hint, violation, reason = opp side, size, reasoning = compute_signal(market, side_hint, violation, reason) if not side: print(f" [skip] {reasoning}") continue ok, why = context_ok(client, market_id) if not ok: print(f" [skip] {why}") continue try: r = client.trade( market_id=market_id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:110]}") if r.success: placed += 1 except Exception as e: print(f" [error] {market_id}: {e}") ``` ### Technical Analysis `MAX_POSITIONS` is described in `SKILL.md` and `clawhub.json` as the maximum number of concurrent open positions. The implementation does not query the account's current positions. Instead, it initializes `placed` to zero for every invocation and increments it only when an order succeeds during that invocation. Consequently, the control limits successful orders per run rather than concurrent account positions. Existing positions, orders from prior runs, and positions created by other processes are omitted. Repeated execution can therefore increase the actual position count far beyond the configured maximum. ### Attack Pat ...[truncated 795 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:353
Finding: Configured minimum market volume is never enforced
Content: View full analysis
tuple[bool, str]: """Check spread and days-to-resolution gates.""" p = getattr(market, "current_probability", None) if not isinstance(p, (int, float)): return False, "missing probability" spread_cents = getattr(market, "spread_cents", None) if isinstance(spread_cents, (int, float)) and spread_cents / 100 > MAX_SPREAD: return False, f"Spread {spread_cents/100:.1%} > {MAX_SPREAD:.1%}" resolves_at = getattr(market, "resolves_at", None) if resolves_at: try: resolves = datetime.fromisoformat(resolves_at.replace("Z", "+00:00")) days = (resolves - datetime.now(timezone.utc)).days if days < MIN_DAYS: return False, f"Only {days} days to resolve" except Exception: pass return True, "ok" ``` ### Technical Analysis The project documents `SIMMER_MIN_VOLUME` as a minimum market-volume filter and loads it into `MIN_VOLUME`. However, neither `valid_market()` nor market discovery compares a market's volume with this threshold. Any parseable market can proceed to signal generation and order submission regardless of its trading volume. The discrepancy gives operators a false expectation that low-liquidity markets are excluded. Low-volume prediction markets are more susceptible to price manipulation, poor depth, and large execution impact. The existing spread check does not replace a volume or depth check, particularly when volume metadata is absent or stale. ### Attack Path 1. Identify or create a low-volume geopolitical market that matches the keyword and ...[truncated 727 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: clawhub.json:6
Finding: Trading SDK dependency is installed without a version or integrity pin
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill references use of an environment credential (SIMMER_API_KEY) and describes trading/execution behavior, but it does not declare any explicit tool scope or permissions boundary. That mismatch can cause the runtime or reviewers to underestimate the skill’s access to sensitive secrets and execution capabilities, increasing the chance of over-privileged deployment or accidental secret exposure.
Content: No source excerpt is available for this finding.