Security audit

Polymarket Cybersecurity Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Polymarket trading skill, but its live-trading safety controls have material gaps that could cause unintended real-money trades.

Review this carefully before installing. Use it only with a limited-risk SIMMER_API_KEY, start in paper mode, avoid reusing the module in a long-lived process after any live run, and consider requiring an extra live-trading confirmation plus pinning simmer-sdk before enabling real-money trading.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: clawhub.json:3
Finding: Unpinned Trading SDK Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:51
Finding: Global Client Cache Can Reuse a Live Trading Client During Paper Mode
Content: View full analysis
SimmerClient: """ live=False → venue="sim" (paper trades — safe default). live=True → venue="polymarket" (real trades, only with --live flag). """ global _client, MAX_POSITION, MIN_VOLUME, MAX_SPREAD, MIN_DAYS, MAX_POSITIONS, YES_THRESHOLD, NO_THRESHOLD, MIN_TRADE if _client is None: venue = "polymarket" if live else "sim" _client = SimmerClient( api_key=os.environ["SIMMER_API_KEY"], venue=venue, ) # Load tunable overrides set via the Simmer UI (SIMMER_* vars only). if live: _client.live = True try: _client.apply_skill_config(SKILL_SLUG) except AttributeError: pass # apply_skill_config only available in Simmer runtime # Re-read params in case apply_skill_config updated os.environ. MAX_POSITION = float(os.environ.get("SIMMER_MAX_POSITION", str(MAX_POSITION))) MIN_VOLUME = float(os.environ.get("SIMMER_MIN_VOLUME", str(MIN_VOLUME))) MAX_SPREAD = float(os.environ.get("SIMMER_MAX_SPREAD", str(MAX_SPREAD))) MIN_DAYS = int(os.environ.get( "SIMMER_MIN_DAYS", str(MIN_DAYS))) MAX_POSITIONS = int(os.environ.get( "SIMMER_MAX_POSITIONS", str(MAX_POSITIONS))) YES_THRESHOLD = float(os.environ.get("SIMMER_YES_THRESHOLD", str(YES_THRESHOLD))) NO_THRESHOLD = float(os.environ.get("SIMMER_NO_THRESHOLD", str(NO_THRESHOLD))) MIN_TRADE = float(os.environ.get("SIMMER_MIN_TRADE", str(MIN_TRADE))) return _client ``` ### Technical Analysis The module stores a single `SimmerClient` in the global `_client` variable. The requested `live` mode is co ...[truncated 1815 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:362
Finding: Configured Minimum-Volume Risk Control Is Never Enforced
Content: View full analysis
None: mode = "LIVE" if live else "PAPER (sim)" print(f"[polymarket-cybersecurity-trader] mode={mode} max_pos=${MAX_POSITION} min_vol=${MIN_VOLUME} max_spread={MAX_SPREAD:.0%} {_timing_tag()}") client = get_client(live=live) markets = find_markets(client) print(f"[polymarket-cybersecurity-trader] {len(markets)} candidate markets") placed = 0 for m in markets: if placed >= MAX_POSITIONS: break side, size, reasoning = compute_signal(m) if not side: print(f" [skip] {reasoning}") continue ok, why = context_ok(client, m.id) if not ok: print(f" [skip] {why}") continue try: r = client.trade( market_id=m.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) ``` The risk parameter is declared and loaded but never used as a gate: ```python MIN_VOLUME = float(os.environ.get("SIMMER_MIN_VOLUME", "8000")) ``` ### Technical Analysis `SIMMER_MIN_VOLUME` is documented as a minimum market-volume filter and is exposed as a configurable tunable. The program also prints the active value at startup. However, neither `find_markets()`, `compute_signal()`, nor the trading loop compares a market's volume against `MIN_VOLUME`. As a result, users can reasonably believe that low-volume markets are excluded while the implementation may submit orders to any keyword-matching market that passes the spread, resolution-time, and context checks. Low-volume prediction markets are more susceptible to price manipulation, shallow liquidity, unstable quoted prob ...[truncated 1287 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill references access to environment-backed credentials via SIMMER_API_KEY and describes live trading capability, but it does not declare any explicit tool scope or permission boundary. In an agent ecosystem, undeclared access to env-derived secrets increases the chance that the runtime grants broader secret access than reviewers or users expect, which is especially sensitive here because the credential authorizes financial actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script enables real-money trading solely via the presence of a --live CLI flag and immediately proceeds to place trades without any secondary confirmation, dry-run summary, environment guard, or interactive acknowledgment. In a trading skill, this increases the chance of accidental financial loss from operator error, misconfigured automation, or unintended invocation in production contexts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.