Security audit

Polymarket Candle Three Soldiers Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Polymarket trading bot, but it needs review because live mode can place real-money trades while some documented risk limits are not actually enforced.

Treat this as a high-risk automated trading skill. It appears purpose-aligned and not malicious, but do not enable live mode unless you are comfortable with real USDC exposure, have externally limited the API key/account funds, and understand that some advertised risk tunables may not reliably cap liquidity, resolution horizon, or total open positions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:362
Finding: Declared Live-Trading Risk Controls Are Not Fully Enforced
Content: View full analysis
tuple[str | None, float, str]: """ Continuation signal after Three White Soldiers or Three Black Crows. Soldiers (UP trend) + next interval < 0.55 -> buy YES (hasn't caught up). Crows (DOWN trend) + next interval > 0.45 -> buy NO (hasn't caught down). """ m = target.market p = target.p q = m.question # Spread gate if m.spread_cents is not None and m.spread_cents / 100 > MAX_SPREAD: return None, 0, f"Spread {m.spread_cents/100:.1%} > {MAX_SPREAD:.1%}" if pattern == "soldiers": lag = 0.55 - p conviction = min(1.0, lag / 0.55) if lag > 0 else 0.05 size = max(MIN_TRADE, round(conviction * MAX_POSITION, 2)) return "yes", size, ( f"3-SOLDIERS -> YES {p:.0%} lag={lag:.0%} size=${size} -- {q[:60]}" ) elif pattern == "crows": lag = p - 0.45 conviction = min(1.0, lag / ...[truncated 3886 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: clawhub.json:3
Finding: Security-Critical Trading SDK Dependency Is Not Version-Pinned
Content: View full analysis
Remediation: View remediation
" ] ``` 2. Use a lock file with cryptographic hashes, or install with a hash-verified requirements file using `--require-hashes`. 3. Record the expected package source and artifact hashes in release documentation. 4. Review dependency updates before changing the pinned version. Include release-note review, static analysis, and live-trading regression tests. 5. Run the Skill under a dedicated, least-privileged operating-system identity and provide only the environment variables required for execution. 6. Restrict the API credential to the minimum trading permissions and financial limits supported by the service, and rotate it if dependency compromise is suspected. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill references a high-value environment credential (SIMMER_API_KEY) but does not declare any explicit tool scope or permissions boundary. In an agent platform, undeclared environment access weakens least-privilege controls and can allow the skill to read sensitive secrets beyond what reviewers or runtime policy expect, which is more dangerous here because the credential grants trading authority for live markets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest requires a live trading API key for an automated trading skill, but the metadata shown to users contains no explicit warning that the skill can place real trades or consume privileged credentials. In this context, missing disclosure materially increases the risk of users enabling the skill without understanding financial consequences, especially because the skill description explicitly targets automated Polymarket trading decisions.
Content: No source excerpt is available for this finding.