Polymarket Eth Midcandle

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:19 AM UTC
• Version: 1.1.1

Overview

This is a disclosed real-money automated trading skill, but it has high-impact financial authority with weak live-mode controls and fail-open safeguards.

Review carefully before installing. Use paper mode first, avoid cron/live mode until you understand the financial risk, keep bet sizes low, do not use --no-safeguards for live trading, restrict the SIMMER_API_KEY server-side if possible, and avoid storing or printing Discord webhook URLs in logs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: eth_midcandle.py:141

Finding

Live Trading Safeguards Fail Open When External Data Is Unavailable

Content

View full analysis

BTC_GATE_THRESHOLD: return False, btc_pct return True, btc_pct except Exception: return True, 0.0 # fail open ``` ```python def check_volume(): if MIN_VOLUME_RATIO <= 0: return True, 0.0 try: url = "https://api.binance.com/api/v3/klines?symbol=ETHUSDT&interval=5m&limit=26" req = _ur.Request(url, headers={"User-Agent": "simmer-ethmc/1.0"}) with _ur.urlopen(req, timeout=10) as resp: data = json.loads(resp.read()) if len(data) < 25: return True, 0.0 vols = [float(k[5]) for k in data] ratio = vols[-2] / (sum(vols[-26:-2]) / 24) return ratio >= MIN_VOLUME_RATIO, round(ratio, 2) except Exception: return True, 0.0 ``` ### Technical Analysis The Skill treats missing, malformed, or unavailable safety data as successful validation. In particular: - Failure to retrieve market ...[truncated 1858 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: eth_midcandle.py:402

Finding

Configuration Output Discloses the Discord Webhook Credential

Content

View full analysis

Remediation

View remediation

` or reveal only a short non-secret suffix. 3. Avoid printing credential-bearing URLs in errors, diagnostics, or automaton output. 4. Ensure configuration and log files use restrictive permissions and are excluded from source control. 5. Document webhook rotation procedures and advise users to rotate any URL previously exposed in logs. 6. Add a regression test confirming that `--config` output never contains the original webhook URL or token. ]]>

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:3

Finding

Security-Critical Third-Party SDK Is Not Version or Integrity Pinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · eth_midcandle.py (reported line 346)May include surrounding context.

python

losses = state.get("consecutive_losses", 0)
            return False, f"Circuit breaker: {losses} consecutive losses — paused until {paused_until[:16]} UTC"
        else:
            # Pause expired — reset
            state["paused_until"] = None
            state["consecutive_losses"] = 0
            _save_cb_state(state)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents capabilities that inherently involve environment variables, file access, and network activity, but it does not declare any explicit tool scope or permissions boundaries. In an agent ecosystem, that omission weakens least-privilege controls and makes it harder for users or platforms to understand and constrain what the skill can access before installation or execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

5. Set up cron

bash

crontab -e

Add:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The commands section exposes a --no-safeguards option that disables flip-flop and slippage checks, but it does not pair that bypass with an immediate, explicit warning in the same section about materially increased execution and loss risk. Because this is a live-trading skill handling real money, normalizing a safety-bypass flag can lead users to disable protections without understanding the consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · eth_midcandle.py (reported line 224)May include surrounding context.

python

return in_window, mins_remaining, candle_start

def binance_klines(symbol, interval, limit, retries=2):
    url = f"https://api.binance.com/api/v3/klines?symbol={symbol}&interval={interval}&limit={limit}"
    for attempt in range(retries):
        try:
            req = _ur.Request(url, headers={"User-Agent": "simmer-ethmc/1.0"})

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · eth_midcandle.py (reported line 279)May include surrounding context.

python

return in_window, mins_remaining, candle_start

def binance_klines(symbol, interval, limit, retries=2):
    url = f"https://api.binance.com/api/v3/klines?symbol={symbol}&interval={interval}&limit={limit}"
    for attempt in range(retries):
        try:
            req = _ur.Request(url, headers={"User-Agent": "simmer-ethmc/1.0"})

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Running with --live causes immediate real-money trade execution without a secondary confirmation or interactive acknowledgement. In a trading skill, this increases the chance of accidental financial loss from mistyped commands, automation misconfiguration, or unattended execution in the wrong environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes a Polymarket ETH scalping strategy with configurable trading gates, but does not mention any alerting or chat-integration capability. Posting trade and circuit-breaker messages to an arbitrary Discord webhook is an additional outbound communication feature that is not necessary to implement the trading logic itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

When DISCORD_WEBHOOK is configured, the code posts trade and circuit-breaker messages to Discord, which sends operational data to a third-party service. The behavior is configurable, but there is no explicit user-facing disclosure in the CLI flow that notifications will be sent externally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.