Security audit

Polymarket Macro Sentiment Divergence Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed trading skill, but its live-trading safeguards do not fully match what it promises.

Use this only in paper mode until the live-trading safeguards are fixed. Before enabling --live, restrict the API key, pin the SDK version, verify minimum-volume filtering, and ensure open positions and pending orders are checked against a real portfolio cap.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:359
Finding: Minimum Market Volume Safeguard Is Declared but Never Enforced
Content: View full analysis
= MAX_POSITIONS: break side, size, reasoning = compute_signal(m, stale_side, divergence) if not side: safe_print(f" [skip] {reasoning}") continue ok, why = context_ok(client, m.id) if not ok: safe_print(f" [skip] {why}") continue try: r = client.trade( market_id=m.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:70]}") if r.success: placed += 1 except Exception as e: safe_print(f" [error] {m.id}: {e}") ``` ### Technical Analysis `MIN_VOLUME` is presented as a risk parameter and is reloaded after skill configuration, but it is not referenced by market discovery, signal computation, or the final order-processing loop. Consequently, a market can reach `client.trade()` regardless of whether its volume is below the configured threshold. Low-volume prediction markets are more susceptible to wide effective execution costs, price manipulation, unreliab ...[truncated 1323 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:359
Finding: Configured Maximum Open Positions Only Limits Orders Within One Invocation
Content: View full analysis
= MAX_POSITIONS: break side, size, reasoning = compute_signal(m, stale_side, divergence) if not side: safe_print(f" [skip] {reasoning}") continue ok, why = context_ok(client, m.id) if not ok: safe_print(f" [skip] {why}") continue try: r = client.trade( market_id=m.id, side=side, amount=size, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) tag = "(sim)" if r.simulated else "(live)" status = "OK" if r.success else f"FAIL:{r.error}" safe_print(f" [trade] {side.upper()} ${size} {tag} {status} -- {reasoning[:70]}") if r.success: placed += 1 except Exception as e: safe_print(f" [error] {m.id}: {e}") ``` ### Technical Analysis `placed` is initialized to zero every time `run()` executes and is incremented only for successful orders during that invocation. The code never queries the account's existing open positions before submitting additional orders. The configuration and documentation describe `MAX_POSITIONS` as a maximum number of concurrent open positions, but the implementation instead treats it as a maximum number of successful orders per process run. Repeated manual, managed, or scheduled executions can therefore continue adding positions beyond the configured portfolio limit. There is also no visible reservation or atomic portfolio-cap operation around o ...[truncated 1255 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: clawhub.json:6
Finding: Security-Sensitive Trading SDK Is Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill references a high-value environment credential (SIMMER_API_KEY) but does not declare any explicit tool scope or permission boundary for environment access. In agent platforms, undeclared env access weakens least-privilege controls and can allow the skill to read sensitive secrets beyond what reviewers or operators expect, which is especially concerning in a trading skill capable of placing live orders.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This manifest requires the SIMMER_API_KEY environment variable, which indicates the skill accesses sensitive credentials. In this JSON file there is no accompanying disclosure about credential handling, privacy implications, or that the skill will use this secret to interact with an external service.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The implementation contradicts the documented strategy: after selecting the stale-side markets as targets, compute_signal can still place YES orders when probability is below YES_THRESHOLD. That means the bot may trade in the same direction as the stale side rather than against it, creating unintended exposure and violating the operator’s stated risk assumptions. In a live trading skill, strategy/implementation divergence is dangerous because users may enable real trading based on the documented behavior while the code executes materially different trades.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.