Polymarket Bundle Btc 5min Streak Trader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:35 AM UTC
• Version: 0.0.3

Overview

This skill is a disclosed Polymarket trading bot, but its safety controls have implementation gaps that could expose users to unintended real-money trades or larger-than-expected positions.

Review before installing. Use paper mode first, provide only a restricted or sandbox trading key if available, avoid reusing the same long-lived Python process across live and paper runs, and do not rely on the documented volume or open-position limits as account-wide protections until the implementation is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: trader.py:49

Finding

Cached Live Client Can Bypass Requested Paper-Trading Mode

Content

View full analysis

SimmerClient: """ live=False -> venue="sim" (paper trades -- safe default). live=True -> venue="polymarket" (real trades, only with --live flag). """ global _client, MAX_POSITION, MIN_VOLUME, MAX_SPREAD, MIN_DAYS, MAX_POSITIONS global YES_THRESHOLD, NO_THRESHOLD, MIN_TRADE, STREAK_LENGTH if _client is None: venue = "polymarket" if live else "sim" _client = SimmerClient( api_key=os.environ["SIMMER_API_KEY"], venue=venue, ) if live: _client.live = True ``` ### Technical Analysis The module stores one `SimmerClient` in the global `_client` variable. The selected venue and live-trading state are established only when `_client` is `None`. Subsequent calls return the existing client without checking whether its venue matches the newly requested `live` argument. Consequently, after the client has been initialized with `live=True`, a later call to `get_client(live=False)` or `run(live=False)` in the same Python process reuses the live Polymarket client. The second execution may print that it is in paper mode while still submitting orders through a client configured for real trading. This is especially relevant in managed runtimes, notebooks, test processes, or embedding applications where the module can remain loaded and `run()` can be invoked more than once. ### Attack Path 1. A process imports `trader.py`. 2. The process invokes `run(live=True)` or `get_cli ...[truncated 837 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: trader.py:388

Finding

Configured Open-Position Limit Only Counts Orders in the Current Run

Content

View full analysis

= MAX_POSITIONS: break streaks = detect_streaks(ivs) if not streaks: safe_print(f" [{date_str}] no streaks of {STREAK_LENGTH}+") continue for streak_dir, streak_len, target in streaks: if placed >= MAX_POSITIONS: break side, size, reasoning = compute_streak_signal(streak_dir, streak_len, target) if not side: safe_print(f" [skip] {reasoning}") continue ok, why = context_ok(client, target.market.id) if not ok: safe_print(f" [skip] {why}") continue try: r = client.trade( market_id=target.market.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:100]}") if r.success: placed += 1 except Exception as e: safe_print(f" [error] {target.market.id}: {e}") ``` ### Technical Analysis `MAX_POSITIONS` is described as a maximum number of concurrent open positions, but the implementation initializes `placed` to zero on every invocation. It increments the counter only after successful orders during that invocation. The code does not retrieve existing open positions or pending orders from ...[truncated 1063 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: trader.py:31

Finding

Declared Minimum-Volume Safeguard Is Never Enforced

Content

View full analysis

Remediation

View remediation

= MIN_VOLUME` in a common validation function used by all signal paths. - Fail closed in live mode if volume is missing, stale, nonnumeric, or obtained from an untrusted field. - Define whether the threshold applies to total volume, recent volume, or available order-book liquidity and document that interpretation. - Consider supplementing total-volume checks with order-book depth and expected execution-price checks. - Add tests confirming that markets below the configured threshold never reach `client.trade()`. ]]>

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:6

Finding

Trading SDK Dependency Is Not Version-Pinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill explicitly requires a high-value credential (SIMMER_API_KEY) and is intended to place trades, but it does not declare any tool scope or permissions boundary. That creates an authorization ambiguity where an agent/runtime may expose broader environment access than necessary, increasing the chance of credential misuse or unintended capability exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest declares a required API credential and an automated trading entrypoint, but provides no user-facing disclosure about how the credential will be used or that the skill performs external networked trading activity. In a trading bot context, this increases the risk of users supplying sensitive credentials without understanding scope, permissions, or potential financial consequences from automated execution.

Content

No source excerpt is available for this finding.