Security audit

Polymarket Bundle Cross Coin 5min Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed trading skill, but it needs Review because some promised live-trading safeguards are not actually enforced and its trading SDK install is unpinned.

Install only if you understand it can place real trades when run with --live. Use paper mode first, use a limited API key, review the unpinned SDK risk, and do not rely on the advertised volume or concurrent-position limits until those checks are fixed or independently enforced.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: clawhub.json:6
Finding: Unpinned Third-Party Trading SDK Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:324
Finding: Configured Minimum Market Volume Safeguard Is Not Enforced
Content: View full analysis
list: """ Find active crypto 5-min Up/Down markets via keyword search and bulk fetch, deduplicated. Uses both find_markets(query=...) and get_markets(limit=200) as fallback since find_markets may miss some. """ seen: set[str] = set() unique: list = [] # Keyword search for kw in KEYWORDS: try: for m in client.find_markets(query=kw): market_id = getattr(m, "id", None) if market_id and market_id not in seen: q = getattr(m, "question", "") if is_crypto_5min_market(q): seen.add(market_id) unique.append(m) except Exception as e: safe_print(f"[search] {kw!r}: {e}") # Bulk fallback -- scan recent/popular markets for crypto Up/Down we may have missed try: for m in client.get_markets(limit=200): market_id = getattr(m, "id", None) if market_id and market_id not in seen: q = getattr(m, "question", "") if ...[truncated 1992 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:406
Finding: Maximum Concurrent Position Limit Only Counts Orders from the Current Run
Content: View full analysis
= MAX_POSITIONS: break market = opp[0] side, size, reasoning = compute_signal(market, opp) if not side: safe_print(f" [skip] {reasoning}") continue ok, why = context_ok(client, market_id) if not ok: safe_print(f" [skip] {why}") continue try: r = client.trade( market_id=market_id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:110]}") if r.success: placed += 1 except Exception as e: safe_print(f" [error] {market_id}: {e}") safe_print(f"[cross-coin-5min] done. {placed} orders placed.") ``` ### Technical Analysis The setting named `MAX_POSITIONS` is documented as a maximum number of concurrent open positions. The implementation initializes `placed` to zero for every process invocation and increments it only after a successful order during that invocation. The code does not query the account's existing open positions or pending orders. It also does not reserve capacity atomically before submitting a trade. Therefore, the control limits only successful submissions in a single sequential execution, not total concurrent account exposure. Repeated runs, overlapping managed executions, or positio ...[truncated 1341 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill references use of an environment credential (SIMMER_API_KEY) and live trading capability, but it does not declare explicit tool scope or permissions boundaries. In an agent environment, missing least-privilege declarations can let the skill access sensitive environment data more broadly than users expect, increasing the chance of credential exposure or unauthorized trading if the runtime grants env access implicitly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The statement that ETH/SOL/XRP 'almost always follow' BTC presents a strong, uncaveated claim about market behavior in natural language. In a financial trading skill, this kind of absolute framing can mislead users about uncertainty and limitations of the strategy, which is a semantic quality concern rather than a scanner-detectable issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.