Security audit

Polymarket Bundle Tennis Set Match Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Polymarket trading skill, but it should go to Review because some live-trading safeguards are under-enforced while it uses a real trading credential.

Install only if you understand and accept live Polymarket trading risk. Keep it in paper mode unless you have reviewed the strategy, pinned and vetted simmer-sdk, scoped SIMMER_API_KEY tightly, and confirmed account-level limits for volume, open positions, pending orders, and total exposure are enforced outside this skill.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

Location: clawhub.json:3
Finding: Unpinned Trading SDK Creates a Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:427
Finding: Configured Minimum Market Volume Safeguard Is Not Enforced
Content: View full analysis
= MAX_POSITIONS: break market = opp[0] side, size, reasoning = compute_signal(market, opp) if not side: safe_print(f" [skip] {reasoning}") continue ok, why = context_ok(client, market_id) if not ok: safe_print(f" [skip] {why}") continue try: r = client.trade( market_id=market_id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:110]}") if r.success: placed += 1 except Exception as e: safe_print(f" [error] {market_id}: {e}") ``` ### Technical Analysis `SIMMER_MIN ...[truncated 1898 chars]
Remediation: View remediation
= MIN_VOLUME` during discovery and repeat the check immediately before live execution. 4. Validate executable order-book depth for the proposed amount, not only aggregate historical volume. 5. Distinguish between total volume, recent volume, and available depth, and document which metric the threshold controls. 6. Add unit tests proving that markets below the threshold and markets with missing volume cannot reach `client.trade()`. 7. Record the observed volume and depth in the trade reasoning or audit log. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:477
Finding: Maximum Position Count Ignores Existing Positions and Pending Orders
Content: View full analysis
= MAX_POSITIONS: break market = opp[0] side, size, reasoning = compute_signal(market, opp) if not side: safe_print(f" [skip] {reasoning}") continue ok, why = context_ok(client, market_id) if not ok: safe_print(f" [skip] {why}") continue try: r = client.trade( market_id=market_id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:110]}") if r.success: placed += 1 except Exception as e: safe_print(f" [error] {market_id}: {e}") ``` ### Technical Analysis The documented `MAX_POSITIONS` control is described as a limit on concurrent open positions. The implementation instead initializes `placed` to zero on each process invocation and increments it only for successful orders submitted during that invocation. The code does not query: - Existing open positions; - Existing pending orders; - Prior positions in the same markets; - Orders concurrently submitted by another Skill instance. As a result, the check limits orders per run rather than concurrent account positions. Repeated or concurrent invocations can exceed the configured risk boundary. The check is also not atomic, so two processes can independently observe capacity and submit orders simultaneously. ### Attack Path 1. The account already has up to `MAX_POSITIONS ...[truncated 1220 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:298
Finding: Invalid Handicap Probability Model Can Trigger Unsupported Live Trades
Content: View full analysis
50% => likely 3 sets => underdog # wins at least one set => set handicap -1.5 favourite should be # lower (harder to cover -1.5 when match likely goes 3 sets) if ts_price > 0.50: # 3-set match likely: handicap -1.5 should be < (1 - ts_price) # because covering -1.5 means winning 2-0 in sets expected_straight_sets = 1.0 - ts_price # P(2-0 finish) if sh_price > expected_straight_sets + MIN_VIOLATION: violation = sh_price - expected_straight_sets opportunities.append(( set_handicap.market, "no", violation, f"\U0001F3BE\U0001F517 Set Hcap -1.5={sh_price:.1%} but " f"P(straight sets)={expected_straight_sets:.1%} from " f"Total Sets O/U 2.5={ts_price:.1%} | " f"violation={violation:.1%} -- {set_handicap.market.question[:55]}" )) elif ts_price < 0.50: # 2-set match likely: handicap -1.5 should be high expected_straight_sets = 1.0 - ts_price if sh_price < expected_straight_sets - MIN_VIOLATION: ...[truncated 3105 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares access to environment-based credentials via SIMMER_API_KEY but does not define any explicit tool scope such as permissions or allowed-tools. In an agent framework, missing scope declarations can cause overbroad runtime access or make it unclear which components may read sensitive environment variables, increasing the risk of credential exposure or unintended privileged actions.
Content: No source excerpt is available for this finding.