Polymarket Macro Crypto Geopolitics Trader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 0.0.3

Overview

This skill is transparently a trading bot, but several documented financial safeguards are not actually enforced strongly enough for live trading.

Review carefully before live use. Keep it in paper mode until the liquidity, position-count, and sizing controls are fixed; if enabling --live, use a limited, revocable API key and conservative account funding.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: trader.py:32

Finding

Declared Minimum-Volume Safeguard Is Not Enforced

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: trader.py:334

Finding

Maximum Concurrent Position Limit Ignores Existing Open Positions

Content

View full analysis

= MAX_POSITIONS: break side, size, reasoning = compute_signal(m, divergence_type) ``` Successful orders only increment the current run's local counter: ```python if r.success: placed += 1 ``` ### Technical Analysis The documented `SIMMER_MAX_POSITIONS` setting is described as the maximum number of concurrent open positions. The implementation instead limits only the number of successful orders placed during one invocation. The skill does not query the account for existing open positions, pending orders, or prior exposure to the same market. Because `placed` is initialized to zero on every run, repeated manual, automated, or scheduled executions can each submit up to `MAX_POSITIONS` additional orders while earlier positions remain open. This also permits repeated exposure to the same market unless the external SDK independently rejects it. No such guarantee is established by the audited code. ### Attack Path 1. The skill is run in live mode and submits up to `MAX_POSITIONS` successful orders. 2. Those positions remain open. 3. The skill is invoked again while the same or another qualifying divergence exists. 4. The local `placed` counter resets to zero. 5. The second invocation can submit up to another `MAX_POSITIONS` orders. 6. Repetition causes total concurrent exposure to exceed the documented limit substantially. An attacker able to trigger repeated execution, or an operator relying on the documented limit, can therefore cause uncontrolled position accumulation. ### Impact Assessment The issue does not grant system-level privileges. It affects the live trading authority available through `SIMMER_API_KEY`. Potential effects include: - Concurrent positions exceeding the configured maximum. - Du ...[truncated 194 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: trader.py:260

Finding

Minimum Trade Size Can Override the Configured Maximum Position Size

Content

View full analysis

Remediation

View remediation

MAX_POSITION: raise ValueError("MIN_TRADE must be positive and no greater than MAX_POSITION") ``` 2. Apply an explicit hard cap to the final amount: ```python calculated = round(conviction * MAX_POSITION, 2) size = min(MAX_POSITION, max(MIN_TRADE, calculated)) ``` 3. Change metadata ranges or add cross-field validation in the configuration interface so invalid combinations cannot be saved. 4. Fail closed rather than silently correcting dangerous live-mode configuration. 5. Add tests for boundary values, including `MIN_TRADE == MAX_POSITION`, `MIN_TRADE > MAX_POSITION`, zero or negative environment values, and non-finite floating-point values. ]]>

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:6

Finding

Privileged Trading SDK Dependency Is Not Version-Pinned

Content

View full analysis

Remediation

View remediation

" ] ``` 2. Use a lockfile with cryptographic hashes and require hash verification during installation. 3. Install only from a trusted, controlled package index. 4. Review the pinned release's source, transitive dependencies, and release provenance. 5. Use automated dependency monitoring, but update only through a reviewed and tested process. 6. Restrict the runtime with least-privilege filesystem and network controls. 7. Keep live-trading credentials scoped, revocable, and separate from broader account credentials. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill references a high-value credential (SIMMER_API_KEY) and describes trading behavior, but it does not declare an explicit tool/permission scope such as allowed environment access. In an agent ecosystem, undeclared env capability weakens least-privilege controls and can allow broader secret access than operators expect, especially for a trading skill that could misuse credentials if execution content later expands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This manifest defines an automated trading skill with a managed entrypoint and configurable position-sizing controls, but it does not provide any explicit user-facing warning that the skill may place real-money trades using configured funds. In a trading context, omission of this disclosure increases the risk of users enabling or deploying the skill without understanding that it can autonomously open positions and incur financial loss.

Content

No source excerpt is available for this finding.