Back to skill

Security audit

Polymarket 48h Geopolitics Cluster Trader

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed automated trading bot, but its live-trading safeguards and dependency controls are not strong enough for unsupervised real-money use.

Review this carefully before installing for anything beyond simulation. Treat SIMMER_API_KEY as trading authority, keep the key and funded balance tightly limited, and do not run with --live until the volume filter, true open-position limits, and dependency pinning or lockfile are addressed.

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
trader.py:347
Finding

Documented live-trading risk controls are not fully enforced

Content
View full analysis
tuple[bool, str]: """Check spread and days-to-resolution gates.""" p = getattr(market, "current_probability", None) if not isinstance(p, (int, float)): return False, "missing probability" spread_cents = getattr(market, "spread_cents", None) if isinstance(spread_cents, (int, float)) and spread_cents / 100 > MAX_SPREAD: return False, f"Spread {spread_cents/100:.1%} > {MAX_SPREAD:.1%}" resolves_at = getattr(market, "resolves_at", None) if resolves_at: try: resolves = datetime.fromisoformat(resolves_at.replace("Z", "+00:00")) days = (resolves - datetime.now(timezone.utc)).days if days < MIN_DAYS: return False, f"Only {days} days to resolve" except Exception: pass return True, "ok" ``` ```python placed = 0 for market_id, opp in sorted(all_opps.items(), key=lambda x: -x[1][2]): if placed >= MAX_POSITIONS: break market, side_hint, violation, reason = opp side, size, reasoning = compute_signal(market, side_hint, violation, reason) if not side: print(f" [skip] {reasoning}") continue ok, why = context_ok(client, market_id) if not ok: print(f" [skip] {why}") continue try: r = client.trade( market_id=market_id, side=side, amount=s ...[truncated 2733 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
clawhub.json:3
Finding

Security-sensitive trading dependency is not version-pinned

Content
View full analysis
Remediation
View remediation
" ] ``` 2. Use a lockfile or hash-verified requirements file so installation verifies the expected distribution artifact. 3. Record the approved package version and cryptographic hash in release metadata. 4. Review upstream release notes and source changes before upgrading the dependency. 5. Use an isolated virtual environment and install only required dependencies. 6. Restrict the API key to the minimum permissions and account balance necessary for the strategy. 7. Rotate the credential if dependency compromise is suspected. 8. Add dependency scanning and provenance verification to the release process, including checks for known vulnerabilities, unexpected ownership changes, and package-name substitution. ]]>
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill declares a required environment credential (SIMMER_API_KEY) and implicitly relies on environment access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and can cause the runtime to grant broader access than reviewers expect, increasing the chance that a credential-handling trading skill can access or misuse sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest declares a required API key and an automated trader entrypoint, but it does not disclose to users that the skill will access credentials and may place trades automatically. In a trading context, that missing warning materially increases the risk of users enabling the skill without understanding account access, capital exposure, or the consequences of autotrading behavior.

Content

No source excerpt is available for this finding.