Security audit

Polymarket Whale Contrarian Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed paper-by-default Polymarket trading skill, but live mode can place real-money trades while some documented safeguards are missing or flawed.

Review carefully before enabling live mode. Keep it in paper mode until trade-direction parsing and advertised safeguards are fixed, pin and verify the SDK dependency, and scope SIMMER_API_KEY to limited trading permissions and account exposure.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:166
Finding: Incorrect trade-side normalization can generate false real-money signals
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: trader.py:42
Finding: Documented liquidity and portfolio exposure safeguards are not enforced
Content: View full analysis
= MAX_POSITIONS: break ``` `MIN_VOLUME` is not referenced by any market-selection or trade-execution check after configuration. The documentation presents stronger guarantees: ```markdown | MIN_DAYS | 7 | Avoid near-resolution noise | | MAX_POSITIONS | 6 | Cap portfolio exposure | | MIN_VOLUME | $5,000 | Skip thin markets | ``` ### Technical Analysis The declared minimum-volume control is nonfunctional because the configured `MIN_VOLUME` value is never compared with market volume. A market can therefore pass the implemented spread and resolution-time checks even when its volume is below the documented threshold. The position control also does not cap simultaneous portfolio positions. It only limits the number of successful orders in one execution. Existing positions are not queried or counted. Repeated invocations can each submit up to `MAX_POSITIONS` additional orders. The implementation therefore provides weaker financial controls than the user-facing ...[truncated 1401 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: clawhub.json:3
Finding: Security-sensitive SDK dependency is unpinned
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes behavior that relies on network access and an environment secret (SIMMER_API_KEY), but it does not declare any explicit tool scope such as allowed tools or permissions. This creates a least-privilege and transparency gap: a runner or reviewer cannot easily tell what external access the skill expects, increasing the risk of unintended network use or secret exposure if the skill is later implemented or executed in a broader-permission environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.