Security audit

Polymarket Bundle Dota2 Bo3 Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed paper-by-default trading skill, but live mode can place real-money trades while important documented risk limits are not actually enforced.

Review before installing for any live account. Keep it in paper mode unless you are prepared for real USDC loss, restrict the API key and account limits, monitor positions externally, and do not rely on SIMMER_MIN_VOLUME or SIMMER_MAX_POSITIONS as documented until those controls are fixed. Pin and review simmer-sdk before production use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:38
Finding: Minimum Market Volume Safeguard Is Declared but Never Enforced
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:504
Finding: Maximum Concurrent Position Limit Resets on Every Execution
Content: View full analysis
= MAX_POSITIONS: break market = opp[0] side, size, reasoning = compute_signal(market, opp) if not side: safe_print(f" [skip] {reasoning}") continue ok, why = context_ok(client, market_id) if not ok: safe_print(f" [skip] {why}") continue try: r = client.trade( market_id=market_id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:110]}") if r.success: placed += 1 ``` The documentation and configuration label `SIMMER_MAX_POSITIONS` as the maximum number of concurrent open positions, but the implementation limits only successful orders placed during the current run. It does not retrieve or count positions opened by earlier runs. ### Technical Analysis A concurrent-position limit must be calculated from persistent portfolio state. The local `placed` variable is ephemeral and does not represent current account exposure. Every manual, scheduled, or concurrent invocation starts with a full allowance of `MAX_POSITIONS`. The implementation also lacks atomicity. Even if an initial position count were added without server-side coordination, two simultaneous processes could observe the same available capacity and both submit orders, exceeding the limit. ### Attac ...[truncated 1053 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: clawhub.json:3
Finding: Unpinned Third-Party SDK Receives a High-Value Trading Credential
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares access to a high-value credential (SIMMER_API_KEY) and describes trading execution, but it does not define any explicit tool scope such as permissions or allowed-tools. In practice, that means the runtime may grant broader environment or tool access than is necessary, violating least privilege and increasing the blast radius if the skill is modified, misused, or composed with other agent behaviors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes an automated trading skill with autostart disabled but explicit position-sizing and trade-threshold controls, which indicates it can place financial trades once run. There is no user-facing disclosure in the manifest about autonomous execution, market risk, loss potential, or the fact that configuration values can materially affect exposure, increasing the chance of uninformed or unsafe deployment.
Content: No source excerpt is available for this finding.