Security audit

Polymarket Climate Trader

Security checks for vulnerabilities and agentic risk

Overview

This trading skill is not clearly malicious, but its live-trading authority is paired with inconsistent documentation and incomplete risk-control enforcement.

Install only if you understand that live mode can place real trades using SIMMER_API_KEY. Use paper mode first, provide a least-privilege or low-funded trading credential, avoid unattended live runs, and treat the documented risk limits as unreliable until the code and manifest defaults are reconciled and the missing liquidity/portfolio checks are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:27
Finding: Market-volume and portfolio-exposure safeguards are not enforced
Content: View full analysis
None: mode = "LIVE" if live else "PAPER (sim)" print(f"[polymarket-climate-trader] mode={mode} max_pos=${MAX_POSITION} min_vol=${MIN_VOLUME} max_spread={MAX_SPREAD:.0%} min_days={MIN_DAYS}") client = get_client(live=live) markets = find_markets(client) print(f"[polymarket-climate-trader] {len(markets)} candidate markets") placed = 0 for m in markets: if placed >= MAX_POSITIONS: break side, size, reasoning = compute_signal(m) if not side: print(f" [skip] {reasoning}") continue ok, why = context_ok(client, m.id) if not ok: print(f" [skip] {why}") continue try: r = client.trade( market_id=m.id, side=side, amount=size, source=TR ...[truncated 2636 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:85
Finding: Documented safety defaults conflict with executable configuration
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: clawhub.json:7
Finding: Unpinned privileged trading SDK creates a supply-chain risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill references environment-variable access for sensitive credentials like SIMMER_API_KEY but does not declare any explicit tool scope or permission boundary. In an automated trading context, undocumented env access increases the chance of over-privileged execution, accidental secret exposure, or the skill being granted broader capabilities than operators expect.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The documentation makes strong safety claims about paper-trading defaults and live trading requiring --live, while also describing cron/autostart behavior in a way that could mislead operators about whether the skill can run automatically. In a financial trading skill, ambiguous execution semantics are dangerous because users may deploy it assuming non-live behavior when configuration or runtime wiring could still trigger real trades or unattended operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest declares an external API credential requirement (SIMMER_API_KEY) for an automated trading skill, but provides no user-facing disclosure about what external service is contacted, what permissions the key grants, or that trades may be executed automatically. In a trading context, this increases the risk of users supplying sensitive credentials without informed consent, which can lead to unauthorized market interaction, financial loss, or overbroad trust in the skill.
Content: No source excerpt is available for this finding.