ClawHub
Back to skill

Security audit

Polymarket Micro Cluster Momentum Trader

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Polymarket trading bot that defaults to simulation and only enters live trading when explicitly run with the live flag.

Install only if you understand this is an automated trading skill. Keep it in paper mode first, review the simmer-sdk dependency, protect SIMMER_API_KEY as a high-value credential, and use --live only when you intentionally want real USDC exposure on Polymarket.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The file asserts that the skill defaults to paper trading and only performs real trades with a `--live` flag, but this is only a documentation claim with no implementation shown to enforce it. For a trading skill handling real funds, unenforced safety-mode claims can mislead users into trusting that execution is safe by default, potentially resulting in unintended live trading and financial loss.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal