Security audit

Polymarket Candle Volume Spike Trader

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about being a Polymarket trading bot, but some documented live-trading safeguards are not actually enforced as described.

Review carefully before enabling live mode. Use a scoped or limited SIMMER_API_KEY if available, keep the default paper mode until you understand the strategy, and do not rely on the documented min-volume or max-open-position settings as account-wide risk controls without fixing or independently verifying them.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:347
Finding: Declared market-volume and portfolio-exposure safeguards are not enforced
Content: View full analysis
= MAX_POSITIONS: break # Find the next 5-min window (spike_time + 5 minutes) next_time = spike_time + 5 next_key = (date_str, next_time) next_window = by_window.get(next_key, {}) if not next_window: safe_print( f" [{date_str} {spike_time//60}:{spike_time%60:02d}] " f"no next window at +5min" ) continue # Find coins in the next window that haven't caught up for coin, m in next_window.items(): if placed >= MAX_POSITIONS: break p = float(m.current_probability) # Check if this coin is lagging (not ye ...[truncated 4017 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: clawhub.json:5
Finding: Third-party trading SDK is installed without a version or integrity pin
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill references a high-value credential (SIMMER_API_KEY) and describes live trading capability, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity: an agent/runtime may grant broader environment or tool access than the skill actually needs, increasing the chance of credential exposure or unintended trading actions if the skill is executed in a permissive environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest declares a required API key and configures a managed trading automaton, but provides no user-facing disclosure that credentials will be used to automate market actions. In a trading context, this increases the risk of users enabling the skill without understanding it can place trades with their account, which can lead to financial loss or unintended credential exposure if the platform’s permission model is misunderstood.
Content: No source excerpt is available for this finding.