Security audit

Polymarket Biotech Trader

Security checks for vulnerabilities and agentic risk

Overview

This skill is an automated prediction-market trader with real-money capability, but its advertised research inputs and risk controls do not fully match the implementation.

Review carefully before installing with a live-capable key. Use paper mode first, pin and review the simmer-sdk dependency, set conservative tunables explicitly, and do not rely on the advertised FDA/PDUFA/base-rate intelligence or volume/open-position safeguards unless the implementation is fixed or externally constrained by account-side limits.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:18
Finding: Declared Minimum-Volume Safeguard Is Not Enforced
Content: View full analysis
= MAX_POSITIONS: break side, size, reasoning = compute_signal(m) if not side: print(f" [skip] {reasoning}") continue ok, why = context_ok(client, m.id) if not ok: print(f" [skip] {why}") continue try: r = client.trade( market_id=m.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" print(f" [trade] {side.upper()} ${size} {tag} {status} — {reasoning[:70]}") if r.success: placed += 1 except Exception as e: print(f" [error] {m.id}: {e}") ``` ### Technical Analysis `MIN_VOLUME` is loaded from the environment and presented as a tunable risk parameter, but neither `compute_signal()` nor the trading loop compares a market's volume against it. Consequently, the configured minimum-volume value has no effect. Liquidity checks are important for prediction-market automation because low-volume markets are more suscepti ...[truncated 1008 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:166
Finding: Maximum Open-Position Limit Only Restricts Orders Within One Run
Content: View full analysis
= MAX_POSITIONS: break side, size, reasoning = compute_signal(m) if not side: print(f" [skip] {reasoning}") continue ok, why = context_ok(client, m.id) if not ok: print(f" [skip] {why}") continue try: r = client.trade( market_id=m.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" print(f" [trade] {side.upper()} ${size} {tag} {status} — {reasoning[:70]}") if r.success: placed += 1 except Exception as e: print(f" [error] {m.id}: {e}") ``` ### Technical Analysis The documentation describes `MAX_POSITIONS` as the maximum number of concurrent open positions. The implementation instead initializes `placed` to zero on every invocation and counts only successful orders placed during that invocation. The code never queries existing positions, pending orders, or current exposure. It also does not prevent repeated purchases in a market already held. As a result, repeated executions can exceed the advertised portfolio limit even though each individual run respects its local counter. ### Attack Path 1. The account already has open positions, or a first execution opens up to `MAX_POSITIONS` positions. 2. The skill is executed again manually or by an external scheduler. 3. `placed` is reset to zero. 4. Existing positions are not retrieved or counted. 5. The second run places additional successful orders. 6. Repeated runs continue accumulating exposure beyond the configured maximum. ### Imp ...[truncated 347 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:18
Finding: Runtime Risk Defaults Contradict Documented Safety Parameters
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: clawhub.json:7
Finding: Trading SDK Dependency Is Unpinned and Receives a Live-Capable Credential
Content: View full analysis
Remediation: View remediation
`. - Use a requirements lockfile with cryptographic hashes and install with hash verification. - Retrieve packages only from an explicitly configured trusted index. - Review release signatures, source code, ownership changes, and dependency changes before upgrading. - Run the skill in a restricted environment with minimal filesystem and network access. - Use a dedicated API key with the minimum required trading permissions and strict account-side spending limits. - Separate paper-trading and live-trading credentials. - Rotate the API key immediately if an installed dependency version is later found to be compromised. - Consider vendoring or independently verifying the small portion of SDK functionality required for live trading. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill markets itself as using FDA calendars, PDUFA timing, and clinical trial registry intelligence, but the described implementation is only a broad keyword scanner with threshold-based trading. In a financial automation context, that mismatch is dangerous because users may grant trading authority under false assumptions about diligence, safeguards, and signal quality, leading to misplaced trust and potentially real monetary loss.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill references environment-based credentials (SIMMER_API_KEY) and discusses trade execution, but it declares no explicit tool or permission scope. That weakens least-privilege guarantees and makes it harder to constrain what an agent may access or expose at runtime, especially in a trading context involving live-capable credentials.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file asserts that the skill defaults to paper trading, does not autostart, and only goes live with an explicit --live flag, but those are unenforced documentation claims in the provided content. If operators rely on that text without code-level enforcement, the skill could execute live trades or run automatically in a misconfigured environment, causing direct financial impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest explicitly requires an API key and describes an automated trading skill, but it provides no user-facing warning that credentials will be used for networked market activity or that the skill can place trades. In a trading context, this omission is risky because users may grant sensitive credentials without clear consent to automated financial actions, increasing the chance of unintended account usage or losses.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The docstring states that trading signals are informed by external biotech sources such as ClinicalTrials.gov, BioMedTracker, and short-interest data, but the implementation only uses market price thresholds and basic market metadata. In an automated trading skill, this mismatch is security-relevant because operators may deploy it with inflated trust in its sophistication and risk controls, leading to unsafe live trading based on misleading documentation.
Content: No source excerpt is available for this finding.