Security audit

Polymarket Copy Consensus Trader

Security checks for vulnerabilities and agentic risk

Overview

This trading skill is mostly transparent about what it does, but its live-trading path has concrete flaws that could trade the wrong market or exceed the user's expected exposure.

Review this carefully before installing for live trading. Paper mode is the default, but do not supply live trading credentials or use --live unless you accept the risk from the unpinned SDK, ambiguous market matching, and per-run rather than account-wide position limiting. Prefer pinning and auditing simmer-sdk, using a revocable low-limit API key, and requiring exact market identity checks before live orders.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: clawhub.json:3
Finding: Unpinned Third-Party Trading Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:266
Finding: Ambiguous Search Fallback Can Trade an Unrelated Market
Content: View full analysis
= MIN_VOLUME: return m # Fallback: return first with sufficient volume for m in results: vol = getattr(m, "volume", 0) or 0 if float(vol) >= MIN_VOLUME: return m except Exception as exc: safe_print(f" [search] '{query[:30]}': {exc}") return None ``` ### Technical Analysis Market titles originate from external leaderboard and activity data. The function attempts to map such a title to a tradable Simmer market by progressively removing trailing words. This can reduce a specific question to a broad or ambiguous prefix. The first matching loop only requires the weakened query to be a substring of the returned market question. More critically, the fallback loop does not compare the market question to the ...[truncated 2096 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:470
Finding: Configured Position Limit Does Not Enforce Existing Open-Position Exposure
Content: View full analysis
= MAX_POSITIONS: safe_print(f" [GATE] Max positions ({MAX_POSITIONS}) reached, stopping") break ``` ```python # Execute trade try: r = client.trade( market_id=m.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:100]}") if r.success: placed += 1 except Exception as exc: safe_print(f" [error] {m.id}: {exc}") skipped += 1 ``` ### Technical Analysis `SIMMER_MAX_POSITIONS` is documented as the maximum number of concurrent open positions. The implementation instead initializes `placed` to zero on every invocation and increments it only after a successful trade during that invocation. The code does not query existing open positions, pending orders, or trades created by previous runs. It also does not reserve capacity atomically before submitting a transaction. Therefore, the check limits only the number of successful trade calls in one process execution, not the account's total concurrent exposure. The mismatch between the documented control and its implementation may give operators a false sense that account-wide exposure is bounded. ### Attack Path 1. The account alrea ...[truncated 1133 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation describes network access to external services and use of environment-based credentials, but it does not declare an explicit tool scope such as allowed network destinations or permitted capabilities. In an agent execution environment, this ambiguity can lead to over-broad access, making it easier for a compromised or modified implementation to use the SIMMER_API_KEY or other environment data beyond the intended Polymarket trading workflow.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.