Polymarket 交易助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:01 AM UTC
• Version: 1.0.2

Overview

The skill only shows a deprecation notice, but it directs users to install an unpinned replacement skill whose contents were not included in this review.

Before installing, verify that polymarket-trade-assistant is the intended replacement from a trusted publisher and prefer a pinned version or signed/checksummed release. Treat this artifact as a pointer to another skill, not as a reviewed trading assistant implementation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:1

Finding

Unpinned External Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 1-2
Vulnerability Type: Unverified and unpinned external dependency installation
Risk Level: Medium

Relevant Code Snippet:

text

openclaw skills install polymarket-trade-assistant

The preceding line states that the current skill is deprecated and directs the user to use the external skill named in this command.

Technical Analysis

The project contains no auditable implementation beyond a deprecation notice that directs users to install polymarket-trade-assistant. The installation command does not specify an immutable version, integrity hash, verified source, or trusted publisher.

Consequently, the effective content installed by this instruction can change independently of the reviewed artifact. A registry compromise, publisher account compromise, malicious package replacement, or unsafe update could cause users to install instructions or executable components that were never included in this audit.

The audited file does not prove that the referenced skill is malicious. The confirmed weakness is that it delegates functionality to an external, unpinned component whose contents and provenance cannot be verified from this project.

Attack Path

1. A user loads this deprecated skill and follows its replacement instruction.
2. The user runs openclaw skills install polymarket-trade-assistant.
3. The installer resolves the external skill using its current mutable package identity rather than a reviewed immutable version and integrity hash.
4. If the external package source or publisher is compromised, attacker-controlled content is returned.
5. The replacement skill is installed and may execute instructions or code using the capabilities granted to the skill runtime.

Impact Assessment

Successful exploitation could allow attacker-controlled skill content to operate with the permissions available to the installer and the resulting ...[truncated 483 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the replacement skill to a reviewed, immutable version rather than installing by an unversioned package name.
2. Require and verify a cryptographic integrity hash or signed release before installation.
3. Document the authoritative registry, repository, publisher identity, and expected package checksum.
4. Vendor the reviewed replacement into the project when feasible so its complete contents can be audited with this artifact.
5. Review the replacement skill's instructions, scripts, dependencies, requested tools, network access, and filesystem permissions before recommending it.
6. Apply least-privilege restrictions during installation and execution, and require explicit user confirmation before granting sensitive capabilities.
7. Replace the current installation instruction with a command or procedure that performs version and integrity verification.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown text is presented only in Chinese and provides no language choice, opt-in, or justification for a locale-specific requirement. This can violate language/locale policy when users are not explicitly offered an alternative.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.