Security audit

Polymarket Macro Calendar Catalyst Trader

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real trading skill, not malware, but it needs Review because live-trading authority is paired with weak dependency control and incomplete advertised safeguards.

Install only if you are comfortable with an automated trading skill handling a high-value API key. Keep it in paper mode unless you have reviewed the strategy, use an API key with strict limits, pin or verify the SDK dependency, and do not rely on the advertised volume and open-position safeguards until they are fixed or enforced account-side.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: clawhub.json:5
Finding: Security-Critical Trading SDK Is Not Version-Pinned
Content: View full analysis
Remediation: View remediation
" ] ``` 2. Use a lock file or hash-locked requirements file, for example: ```text simmer-sdk== \ --hash=sha256: ``` 3. Verify the package's publisher, repository, release signatures, and distribution hashes before updating. 4. Review transitive dependencies and pin them through a reproducible dependency lock. 5. Run the skill in a restricted environment with only the necessary filesystem and network access. 6. Limit the API key to the minimum required permissions and financial exposure. 7. Treat dependency updates as security-sensitive changes requiring code review and testing before deployment. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:83
Finding: Configured Liquidity and Portfolio Exposure Safeguards Are Not Enforced
Content: View full analysis
= MAX_POSITIONS: break side, ...[truncated 3810 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill references a high-value credential (SIMMER_API_KEY) and describes trading actions, but it does not declare any explicit tool scope or permissions boundary in the skill metadata. That omission weakens least-privilege controls and can allow an agent runtime to grant broader environment access than necessary, increasing the risk of unintended secret exposure or unauthorized live trading if the skill is executed in a permissive context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.