T08 · Insecure Dependencies
Error
- Location
clawhub.json:3- Finding
Unpinned Third-Party Trading SDK Creates a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Polymarket Copy Profit Taker Trader
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed paper-by-default trading skill, but its live-trading risk controls and rotation logic do not fully match the safety claims users would rely on.
Install only if you are comfortable reviewing the live-trading behavior first. Keep it in paper mode unless the SDK is pinned and audited, the rotation-window bug is fixed, and live orders fail closed whenever portfolio position checks cannot be verified. Use a tightly scoped, revocable SIMMER_API_KEY with low account limits.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
trader.py:412- Finding
Position-Limit Guard Fails Open and Is Not Enforced Before Every Rotation Trade
- Content
View full analysis
bool: """Check portfolio context to prevent excessive positions.""" try: positions = client.get_positions() open_count = len([p for p in positions if float(getattr(p, "size", 0)) > 0]) if open_count >= MAX_POSITIONS: safe_print(f" [GATE] Already at {open_count}/{MAX_POSITIONS} positions, skipping") return False except Exception as exc: safe_print(f" [WARN] Could not check positions: {exc}") return True ``` The rotation phase performs the check only once before processing all targets: ```python if not context_ok(client): safe_print("\nAborted: portfolio context check failed.") return executed = 0 skipped = 0 seen_markets: set[str] = set() ``` Each rotation target can then submit a trade without another position-limit check: ```python try: r = client.trade( market_id=m.id, side=side, amount=size, source=TRADE_SOURCE, ) safe_print(f" TRADE: {side.upper()} ${size:.2f} on {m.question[:60]}") safe_print(f" -> {r}") executed += 1 ``` ### Technical Analysis `context_ok()` is intended to enforce `MAX_POSITIONS`, but it returns `True` whenever `client.get_positions()` raises an exception. This is a fail-open design: inability to establish that the portfolio is safe is interpreted as permission to continue trading. The rotation-target loop also checks the portfolio only once. If the account starts below the limit, several rotation targets may each open a position and cause the portfolio to exceed `MAX_POSITIONS`. Unlike the fallback loop, the rotation loop does not invoke `c ...[truncated 1733 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
trader.py:255- Finding
Configured Rotation Time Window Is Not Enforced
- Content
View full analysis
list[tuple[str, str, str, str, float]]: """Detect rotation patterns: whale exits market A AND enters market B. For each wallet: find markets where they're TAKING_PROFIT and markets where they're ACCUMULATING. If same wallet does both within the rotation window -> rotation detected. Args: all_wallet_positions: wallet -> list of position change tuples rotation_window_hours: time window for rotation detection Returns: list of (wallet, exit_market, entry_market, entry_side, entry_conviction) entry_conviction = how much they're putting into the new position relative to what they're taking out """ rotations = [] for wallet, positions in all_wallet_positions.items(): exits = [] entries = [] for title, side, buy_total, sell_total, sell_ratio, status in positions: if status == "TAKING_PROFIT": exits.append((title, sell_total, sell_ratio)) elif status == "ACCUMULATING": entries.append((title, side, buy_total)) if not exits or not entries: continue # Each exit/entry pair is a potential rotation total_exit_value = sum(sell_total for _, sell_total, _ in exits) for exit_title, exit_sold, exit_ratio in exits: for entry_title, entry_side, entry_bought in entries: # entry_conviction: how much of the exit capital went to this entry if total_exit_value > 0: entry_conviction = min(1.0, entry_bought / total_exit_value) else: ...[truncated 2799 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared purpose frames the skill as detection/identification of whale exits and rotations, but the content clearly describes autonomous trade execution, optional live trading, fallback trading beyond explicit rotation targets, and broader market selection logic. This mismatch is dangerous because operators may approve or invoke the skill expecting passive analytics, while it can place trades and take financial actions with real capital under a less restrictive trust model.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code claims to detect rotations only when a whale exits one market and enters another within a configured time window, but the implementation never checks exit and entry timestamps when pairing them. This can generate false 'rotation' signals from unrelated historical trades, causing the bot to trade live on fabricated smart-money flow and undermining the core safety logic of the strategy.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises network access and use of an environment variable (
SIMMER_API_KEY) but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent framework, undeclared env/network capabilities reduce transparency and policy enforcement, making it easier for a skill to access secrets or external endpoints beyond what reviewers expect.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill advertises a strategy centered on copying whale profit-taking rotations, but the fallback branch places trades on any 'ACCUMULATING' market that passes generic threshold checks, even when no rotation signal exists. In an automated trading skill, this strategy drift is dangerous because operators may enable live mode expecting one constrained behavior while the code executes a broader, materially different trading policy.
- Content