Security audit

Polymarket Oracle

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Polymarket scanning/trading skill, but its setup instructions repeatedly encourage storing a powerful wallet private key in long-lived files even though the bot does not need it at runtime.

Review carefully before installing. Do not store a real wallet private key in systemd, ~/.bashrc, a project .env, or /etc/polymarket-oracle/credentials.env. If testing, use simulation mode or a low-value wallet, generate API credentials on a trusted local machine, remove WALLET_PRIVATE_KEY from runtime configuration, pin and verify dependencies used for credential generation, and confirm the code’s actual trading behavior before using real funds.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SYSTEMD_SETUP.md:53
Finding: Unnecessary Persistent Storage of the Wallet Private Key
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: CONFIGURATION.md:50
Finding: Unpinned Third-Party Package Used in Wallet Credential Generation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (109)

Intent-Code Divergence

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The systemd example embeds WALLET_PRIVATE_KEY directly in the unit configuration even though the guide previously says the private key must never be stored on the server. A systemd unit may be readable by privileged support tooling, backups, misconfigured permissions, process inspection, or accidental sharing, and exposure of this key grants irreversible full wallet control and fund theft.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONFIGURATION.md (reported line 130)May include surrounding context.
md
# On your SERVER (where bot runs) # Create secure credentials file sudo mkdir -p /etc/polymarket-oracle sudo nano /etc/polymarket-oracle/credentials.env # Paste ONLY these (NO private key!): POLYMARKET_API_KEY=your_api_key_from_step1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONFIGURATION.md (reported line 141)May include surrounding context.
md
# On your SERVER (where bot runs) # Create secure credentials file sudo mkdir -p /etc/polymarket-oracle sudo nano /etc/polymarket-oracle/credentials.env # Paste ONLY these (NO private key!): POLYMARKET_API_KEY=your_api_key_from_step1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONFIGURATION.md (reported line 142)May include surrounding context.
md
# On your SERVER (where bot runs) # Create secure credentials file sudo mkdir -p /etc/polymarket-oracle sudo nano /etc/polymarket-oracle/credentials.env # Paste ONLY these (NO private key!): POLYMARKET_API_KEY=your_api_key_from_step1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONFIGURATION.md (reported line 151)May include surrounding context.
md
# On your SERVER (where bot runs) # Create secure credentials file sudo mkdir -p /etc/polymarket-oracle sudo nano /etc/polymarket-oracle/credentials.env # Paste ONLY these (NO private key!): POLYMARKET_API_KEY=your_api_key_from_step1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONFIGURATION.md (reported line 154)May include surrounding context.
md
# On your SERVER (where bot runs) # Create secure credentials file sudo mkdir -p /etc/polymarket-oracle sudo nano /etc/polymarket-oracle/credentials.env # Paste ONLY these (NO private key!): POLYMARKET_API_KEY=your_api_key_from_step1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONFIGURATION.md (reported line 165)May include surrounding context.
md
# On your SERVER (where bot runs) # Create secure credentials file sudo mkdir -p /etc/polymarket-oracle sudo nano /etc/polymarket-oracle/credentials.env # Paste ONLY these (NO private key!): POLYMARKET_API_KEY=your_api_key_from_step1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SYSTEMD_SETUP.md (reported line 358)May include surrounding context.
md
# On your SERVER (where bot runs) # Create secure credentials file sudo mkdir -p /etc/polymarket-oracle sudo nano /etc/polymarket-oracle/credentials.env # Paste ONLY these (NO private key!): POLYMARKET_API_KEY=your_api_key_from_step1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SYSTEMD_SETUP.md (reported line 359)May include surrounding context.
md
# On your SERVER (where bot runs) # Create secure credentials file sudo mkdir -p /etc/polymarket-oracle sudo nano /etc/polymarket-oracle/credentials.env # Paste ONLY these (NO private key!): POLYMARKET_API_KEY=your_api_key_from_step1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SYSTEMD_SETUP.md (reported line 368)May include surrounding context.
md
# On your SERVER (where bot runs) # Create secure credentials file sudo mkdir -p /etc/polymarket-oracle sudo nano /etc/polymarket-oracle/credentials.env # Paste ONLY these (NO private key!): POLYMARKET_API_KEY=your_api_key_from_step1

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONFIGURATION.md (reported line 169)May include surrounding context.
md
❌ Commit WALLET_PRIVATE_KEY to git ❌ Store private key anywhere long-term # ❌ NEVER use .env file in project directory ❌ cat > .env << 'EOF' ❌ WALLET_PRIVATE_KEY="..." ❌ EOF

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CONFIGURATION.md (reported line 170)May include surrounding context.
md
❌ Commit WALLET_PRIVATE_KEY to git ❌ Store private key anywhere long-term # ❌ NEVER use .env file in project directory ❌ cat > .env << 'EOF' ❌ WALLET_PRIVATE_KEY="..." ❌ EOF

Credential Access

High

Category: Privilege Escalation
Confidence: 83% confidence
Finding: The stray 'chmod 600 .env' line appears immediately after a section warning never to use a project .env for the private key, creating contradictory guidance around local secret storage. Even though chmod tightens permissions, this inconsistency can normalize creation of a project-directory .env that may later contain sensitive material and be accidentally committed, backed up, or exposed.
Content: Scanner excerpt · CONFIGURATION.md (reported line 193)May include surrounding context.
The bot code uses ONLY API credentials at runtime.

chmod 600 .env

text
---

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document explicitly states the wallet private key is only needed once and must never be stored on the server, but later instructs users to export and persist WALLET_PRIVATE_KEY in their shell environment and startup files. This contradiction can lead operators to store a full-control blockchain secret long-term on disk, making theft via local compromise, backups, logs, shell history, or config disclosure far more damaging than exposure of limited-scope API keys.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The configuration section instructs users to store the wallet private key in environment variables and to make it permanent in ~/.bashrc or ~/.zshrc, despite earlier advice forbidding long-term server storage. Persisting secrets in shell startup files increases exposure through backups, home directory compromise, debug output, and accidental disclosure to other tools or users on the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The unit file example places multiple secrets directly in the service definition, including the wallet private key, without a local warning in that section. Inline secrets in unit files are easy to mishandle operationally and especially dangerous here because one of them is a non-revocable wallet key that enables total asset compromise.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose emphasizes scanning and arbitrage detection, but the skill also describes authenticated order placement, Telegram transmission, and local data persistence that are not clearly bounded in the high-level description. This mismatch is dangerous because users or orchestration systems may invoke what appears to be an analysis tool while actually authorizing real-money execution and external data transfer.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 91% confidence
Finding: The documented capability includes authenticated POST /order and DELETE /order operations, enabling the skill to place and cancel live market orders. In a real-money trading environment, this is dangerous if exposed without strict parameter validation, explicit authorization boundaries, and execution controls, because malformed or abused parameters can trigger unintended trades, excessive churn, or financial loss.
Content: Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.
GET /midpoint?token_id={id} - Midpoint price GET /price?token_id={id}&side={BUY/SELL} - Best price POST /order - Place order DELETE /order - Cancel order

Rate limit: Public 60/min, Authenticated 100/min

text

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The documentation tells users to create a plaintext credentials file containing exchange secrets, a wallet private key, and messaging tokens. Even with restrictive permissions, plaintext secret files on disk remain high-value targets for local compromise, backup leakage, operator mishandling, or accidental exposure, especially given the presence of a private key that can authorize trades and move funds.
Content: Scanner excerpt · SYSTEMD_SETUP.md (reported line 346)May include surrounding context.
bash
# Create credentials file sudo mkdir -p /etc/polymarket-oracle sudo nano /etc/polymarket-oracle/credentials.env # Content: POLYMARKET_API_KEY=your_key

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The parity arbitrage detector fabricates the NO price as 1.0 - yes_price instead of querying the actual opposing market price, so yes_price + no_price will always equal 1 and meaningful arbitrage detection cannot occur. In an automated trading bot, flawed strategy logic can cause systematically incorrect signals, missed opportunities, or unsafe execution decisions if later extended to trading, creating direct financial risk.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · CONFIGURATION.md (reported line 19)May include surrounding context.
md
## Step 1: Polymarket Account Setup ### **Create Account** 1. Go to https://polymarket.com 2. Click "Connect Wallet"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · CONFIGURATION.md (reported line 141)May include surrounding context.
POLYMARKET_CAPITAL=10000

Secure the file

sudo chmod 600 /etc/polymarket-oracle/credentials.env sudo chown root:root /etc/polymarket-oracle/credentials.env

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · CONFIGURATION.md (reported line 193)May include surrounding context.
POLYMARKET_CAPITAL=10000

Secure the file

sudo chmod 600 /etc/polymarket-oracle/credentials.env sudo chown root:root /etc/polymarket-oracle/credentials.env

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SYSTEMD_SETUP.md (reported line 358)May include surrounding context.
POLYMARKET_CAPITAL=10000

Secure the file

sudo chmod 600 /etc/polymarket-oracle/credentials.env sudo chown root:root /etc/polymarket-oracle/credentials.env

text

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: The 'Make Permanent' section tells users to place secrets, including WALLET_PRIVATE_KEY, into ~/.bashrc or ~/.zshrc for automatic loading. That creates long-lived secret persistence in common user files that are broadly exposed to backups, support access, accidental sharing, and post-compromise harvesting, and it directly conflicts with the earlier rule never to store the private key long-term.
Content: Scanner excerpt · CONFIGURATION.md (reported line 275)May include surrounding context.
Make Permanent

bash
# Add to ~/.bashrc or ~/.zshrc cat >> ~/.bashrc << 'EOF' # Polymarket Oracle export POLYMARKET_API_KEY="..."

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Intent-Code Divergence

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Tp4

Tool Parameter Abuse

Credential Access

Intent-Code Divergence

Session Persistence

Sudo/Root Execution

Secure the file

Sudo/Root Execution

Secure the file

Sudo/Root Execution

Secure the file

Session Persistence

Make Permanent

Static analysis