Security audit

Polymarket Micro Cluster Momentum Trader

Security checks for vulnerabilities and agentic risk

Overview

This trading skill is mostly transparent about its purpose, but it has artifact-backed live-trading risk controls that can fail or mislead users.

Review this carefully before installing. Use paper mode first, avoid invoking live and paper runs in the same persistent process, keep SIMMER_MIN_TRADE less than or equal to SIMMER_MAX_POSITION, scope and rotate SIMMER_API_KEY, and prefer a pinned reviewed simmer-sdk version before enabling live trading.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:54
Finding: Process-global client caching can retain live-trading authority during a paper-mode run
Content: View full analysis
SimmerClient: global _client, MAX_POSITION, MIN_VOLUME, MAX_SPREAD, MIN_DAYS, MAX_POSITIONS global YES_THRESHOLD, NO_THRESHOLD, MIN_TRADE, CLUSTER_BIAS, MIN_CLUSTER_SIZE if _client is None: venue = "polymarket" if live else "sim" _client = SimmerClient( api_key=os.environ["SIMMER_API_KEY"], venue=venue, ) if live: _client.live = True try: _client.apply_skill_config(SKILL_SLUG) except AttributeError: pass # apply_skill_config only available in Simmer runtime return _client ``` The cached client is later obtained based on the requested execution mode: ```python def run(live: bool = False) -> None: mode = "LIVE" if live else "PAPER (sim)" safe_print( f"[cluster-momentum] mode={mode} max_pos=${MAX_POSITION} " f"cluster_bias={CLUSTER_BIAS:.0%} min_cluster={MIN_CLUSTER_SIZE}" ) client = get_client(live=live) ``` ### Technical Analysis The module maintains one process-global `_client`, but the cached instance is not associated with the mode used to create it. The `live` argument is only considered while `_client` is `None`. If a persistent process first calls `run(live=True)`, the cached client uses the `polymarket` venue and has `_client.live = True`. A subsequent `run(live=False)` prints `PAPER (sim)` but receives the existing live client. Trade requests later sent through `client.trade()` can consequently reach the live venue despite the current run being presented as simulated. The inverse transition also behaves incorrectly: a client first initialized in simulation mode remains simulated when ...[truncated 1269 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:409
Finding: Minimum trade sizing can exceed the configured maximum-position limit
Content: View full analysis
Remediation: View remediation
MAX_POSITION`. - Enforce the maximum directly in the sizing expression: ```python calculated = round(conviction * MAX_POSITION, 2) size = min(MAX_POSITION, max(MIN_TRADE, calculated)) ``` - If the venue's minimum order exceeds `MAX_POSITION`, skip the trade rather than silently violating the maximum. - Validate all numeric inputs for finite, non-negative values and enforce the same bounds in code rather than relying solely on UI metadata. - Add unit tests for boundary combinations, including `MIN_TRADE == MAX_POSITION`, `MIN_TRADE > MAX_POSITION`, and very low conviction. - Treat risk-limit violations as fatal configuration errors in live mode. ]]>

T08 · Insecure Dependencies

Warning

Location: clawhub.json:7
Finding: Privileged trading dependency is installed without a version or integrity pin
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill requires access to a high-value environment credential (SIMMER_API_KEY) but does not declare any explicit tool scope or permissions boundary. That makes the skill's secret access implicit rather than constrained, increasing the chance that an agent runtime exposes broader environment data than necessary or that future modifications use undeclared capabilities without review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest clearly defines an automated trading skill with configurable position sizing, thresholds, and managed entrypoint execution, but it provides no user-facing warning that the skill can autonomously place market trades and incur financial loss. In a financial trading context, omission of explicit risk disclosure is dangerous because users may enable or tune the bot without understanding exposure, slippage, or the risks of autonomous decision-making.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.