Security audit

Polymarket Candle Cross Asset Divergence Trader

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about being a trading bot, but some documented risk controls are not actually enforced and its trading dependency is unpinned.

Review carefully before installing for live use. Paper mode is the default, but do not run with --live unless you are comfortable with the missing volume filter, the per-run position limit, and an unpinned dependency having access to SIMMER_API_KEY. Prefer a restricted/revocable API key and verify account-level trading limits outside this skill.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: clawhub.json:6
Finding: Unpinned Third-Party Trading Dependency
Content: View full analysis
Remediation: View remediation
" ] ``` 2. Use a lock file that records transitive dependency versions. 3. Require package hashes during installation, such as through a hash-locked requirements file and `pip --require-hashes`. 4. Review release provenance and verify that packages originate from the intended publisher. 5. Run the dependency with the minimum necessary environment and filesystem access. 6. Use a restricted API credential with transaction limits, revocation support, and no unrelated account privileges. 7. Re-audit the dependency before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:29
Finding: Documented Minimum-Volume Safeguard Is Not Enforced
Content: View full analysis
= MAX_POSITIONS: break side, size, reasoning = compute_signal( follower_mkt, btc_dir, divergence, coin, btc_p, follower_p ) if not side: safe_print(f" [skip] {reasoning}") continue ok, why = context_ok(client, follower_mkt.id) if not ok: safe_print(f" [skip] {why}") continue try: r = client.trade( market_id=follower_mkt.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning= ...[truncated 1526 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:334
Finding: Concurrent Position Limit Only Counts Orders Placed During the Current Run
Content: View full analysis
= MAX_POSITIONS: break side, size, reasoning = compute_signal( follower_mkt, btc_dir, divergence, coin, btc_p, follower_p ) if not side: safe_print(f" [skip] {reasoning}") continue ok, why = context_ok(client, follower_mkt.id) if not ok: safe_print(f" [skip] {why}") continue try: r = client.trade( market_id=follower_mkt.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:70]}") if r.success: placed += 1 ``` ### Technical Analysis `MAX_POSITIONS` is described as the maximum number of concurrent open positions. The implementation does not query current account positions or outstanding orders. Instead, it initializes `placed` to zero on every invocation and increments it only for successful orders submitted during that invocation. As a result, the control is a per-run successful-order limit, not a concurrent-position limit. Repeated manual execution or managed automation can accumulate significantly more open positions than configured. Concurrent invocations also have no shared state or atomic reservation mechanism, so each process can independently submit up to the full limit. ### Attack Path 1. The account already has open positions from an earlier execution. 2. The Skill is executed again, manually or through managed automation. 3. `placed` i ...[truncated 907 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill references a high-value credential (SIMMER_API_KEY) and implies environment-based access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent/runtime may grant broader environment access than necessary, increasing the chance of unintended secret exposure or misuse if the skill is executed in a permissive host.
Content: No source excerpt is available for this finding.