Security audit

Polymarket Macro Risk Regime Trader

Security checks for vulnerabilities and agentic risk

Overview

This trading skill is mostly transparent, but its live-trading risk controls do not fully match the documented safeguards users would rely on.

Review before installing, especially if you plan to use --live. Use only a limited Simmer/Polymarket key, keep paper mode unless you accept the strategy risk, and do not rely on the documented minimum-volume or max-open-position safeguards until the implementation enforces them. Pinning simmer-sdk to a reviewed version would also reduce dependency risk.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: clawhub.json:7
Finding: Unpinned Third-Party Trading SDK Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
" ] ``` 2. Use a lock file or deployment mechanism that records cryptographic hashes for all direct and transitive dependencies. 3. Install dependencies with hash verification, such as `pip install --require-hashes`. 4. Review the pinned package artifact and its transitive dependency tree before deployment. 5. Use a private package mirror or allowlisted artifact repository where practical. 6. Monitor the dependency for publisher changes, unexpected releases, vulnerabilities, and package-repository compromise. 7. Restrict the API key to the minimum necessary trading permissions and financial limits, and rotate it if dependency compromise is suspected. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:325
Finding: Declared Minimum-Volume Trading Safeguard Is Not Enforced
Content: View full analysis
= MAX_POSITIONS: break side, size, reasoning = compute_signal(m, regime) if not side: safe_print(f" [skip] {reasoning}") continue ok, why = context_ok(client, m.id) if not ok: safe_print(f" [skip] {why}") continue try: r = client.trade( market_id=m.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) ``` The documentation describes `SIMMER_MIN_VOLUME` as a minimum market-volume filter, but no such filter appears in the trading path. ### Technical Analysis Liquidity checks are an important control for automated trading because quoted probability and spread alone do not establish that an order can be filled safely at an acceptable price. The code enforces a spread threshold and a minimum time to resolution, but never reads a market-volume field or compares one against `MIN_VOLUME`. As ...[truncated 1702 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:325
Finding: Maximum Concurrent-Position Limit Resets on Every Invocation
Content: View full analysis
= MAX_POSITIONS: break ``` The counter is incremented only after a successful trade response: ```python safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:70]}") if r.success: placed += 1 ``` No existing positions are retrieved before the loop, and the counter does not represent concurrent open positions. ### Technical Analysis `SIMMER_MAX_POSITIONS` is documented as the maximum number of concurrent open positions. The implementation instead enforces a maximum number of successful orders placed during one process invocation. For example, if eight positions are already open and `MAX_POSITIONS` is eight, a new invocation still initializes `placed` to zero and can place eight additional orders. Repeated invocations can therefore grow the number of open positions beyond the configured limit. The code also does not deduplicate against existing positions in the same market. Depending on SDK and venue behavior, repeated runs may add to existing exposure rather than opening a distinct position, but either behavior defeats the intended aggregate risk cap. ### Attack Path 1. The skill runs and successfully opens up to `MAX_POSITIONS` positions. 2. Those positions remain open. 3. The skill is invoked again manually, by an external scheduler, or through the managed runtime. 4. `placed` resets to zero. 5. The code does not query the account’s currently open positions. 6. Another set of up to `MAX_POSITIONS` successful orders is submitted. 7. Repeated invocations continue accumulating positions or increasing exposure in existing markets. If an ...[truncated 735 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares access to a high-value environment credential (SIMMER_API_KEY) but does not define any explicit tool scope such as permissions or allowed-tools. In an agent runtime, missing scope boundaries can let the skill access environment data more broadly than intended, increasing the chance of credential exposure or misuse if the skill is modified, chained with other tools, or run in a less restrictive host configuration.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest requires a SIMMER_API_KEY for an external service but provides no visible disclosure in this file about credential use, data sharing, or the fact that the skill depends on third-party API access. In an automated trading skill, silent external connectivity increases risk because users may supply credentials without understanding what service is contacted or what actions may be performed with that access.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.