Security audit

Vincent - Polymarket

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly for autonomous Polymarket trading, but it gives an agent high-impact financial authority with weak onboarding safeguards and mutable command execution.

Review this carefully before installing. Claim the wallet and configure strict policies before funding it, avoid leaving funds in an unclaimed wallet, prefer a pinned and reviewed CLI version instead of `@latest`, and do not paste re-link tokens into ordinary chat unless you accept the credential exposure risk.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:336
Finding: Unrestricted Financial Operations Before Wallet Ownership Claim
Content: View full analysis
--to --amount ``` ```text Before the wallet is claimed, the agent can operate without policy restrictions. This is by design: agent-first onboarding allows the agent to begin trading immediately. Once the human operator claims the wallet via the claim URL, they can add any combination of policies to constrain the agent's behavior. The wallet owner can also revoke the agent's API key entirely at any time. ``` ### Technical Analysis The Skill intentionally permits autonomous financial operations before a human has claimed the wallet or configured server-side policies. During this initial state, the API credential can authorize bets, transfers, redemptions, and withdrawals without spending limits or approval thresholds. The withdrawal interface accepts any syntactically valid recipient address. Consequently, the authority available before claim exceeds the minimum privileges necessary for wallet creation, address retrieval, funding instructions, or market browsing. The advertised human-oversight controls only become effective after the owner completes the claim process. This creates a vulnerable authorization window. Prompt injection, incorrect agent reasoning, misuse of the stored API credential, or execution by a ...[truncated 1458 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:58
Finding: Mutable NPM Package Downloaded and Executed Through npx
Content: View full analysis
--token-id --side BUY --amount 5 --price 0.55 ``` ```bash npx @vincentai/cli@latest polymarket withdraw --key-id --to --amount ``` ```bash npx @vincentai/cli@latest secret relink --token ``` ### Technical Analysis Every documented operation uses `npx @vincentai/cli@latest`. The `latest` tag is mutable, so the package code executed at invocation time is not necessarily the version that existed when the Skill was reviewed. `npx` may download and execute the selected package from the npm registry. The effective executable payload can therefore change without any corresponding modification to `SKILL.md`. No exact version, lockfile, integrity digest, vendored artifact, or signature-verification procedure is specified. This is particularly sensitive because the package handles wallet creation, persisted API credentials, one-time re-link tokens, trades, transfers, and withdrawals. A compromised publisher account, malicious release, registry compromise, or dependency compromise could introduce arbitrary code with the permissions of the agent process. ### Attack Path 1. An attacker compromises the package publisher, npm account, release pipeline, registry path, or a transitive dependency. 2. The attacker publishes a hostile release and assigns it to the `latest` distribution tag. 3. The agent follows the Skill and runs a normal `npx @vincentai/cli@latest` command. 4. `npx` retrieves and executes ...[truncated 897 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:342
Finding: One-Time Re-link Credential Exposed Through Chat and Command-Line Arguments
Content: View full analysis
``` ```text The CLI exchanges the token for a new API key, stores it automatically, and returns the new `keyId`. Use this `keyId` for all subsequent commands. **Important:** Re-link tokens are one-time use and expire after 10 minutes, so it's safe for users to send you a relink token through chat since you will immediately consume it. ``` ### Technical Analysis The re-link token is a bearer credential because possession permits exchange for a new scoped API key. The instructions explicitly encourage users to paste this credential into chat and then pass it as a command-line argument. Chat content may be retained in transcripts, observability systems, debugging records, model-provider logs, or administrative interfaces. Command-line arguments may also be visible through process inspection, command logging, audit telemetry, or shell history, depending on the execution environment. One-time use and a ten-minute expiration reduce the exploitation window but do not make disclosure safe. An observer can race the legitimate agent to redeem the token. The assertion that sending the token through chat is safe understates the security properties required for a credential capable of restoring wallet API access. ### Attack Path 1. The wallet owner generates a valid re-link token. 2. Following the Skill's instructions, the owner pastes the token into chat. 3. The token is retained or exposed through a transcript, logging system, monitoring integration, compromised chat account, or privileged ob ...[truncated 1029 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly states that before wallet claim, the agent can operate without policy restrictions. In a skill designed for autonomous trading and withdrawals, this creates a dangerous pre-claim window where an agent or injected prompt could perform unrestricted financial actions before the human owner applies limits or approval gates.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list contains broad phrases like 'betting' and 'market odds' that can match ordinary conversation and unintentionally activate a financially sensitive skill. Because the skill can create wallets and place trades, overbroad routing materially increases the risk of accidental invocation or prompt-injection chaining into financial operations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation claims the agent never handles raw keys or file paths, yet the skill metadata explicitly declares credential persistence locations and states the CLI stores API keys automatically on disk. That mismatch can create a false sense of safety: any process or skill with local file access may target those paths and recover scoped tokens, especially since Read is allowed.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation states all API calls go exclusively to heyvincent.ai and no other external hosts are contacted, yet the described workflow involves polymarket.com profile links and Telegram notifications. Even if some of those are user-facing rather than API calls, the absolute claim is misleading and can impair risk assessment of data flows and third-party dependencies.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill repeatedly instructs execution of npx @vincentai/cli@latest, which pulls and runs code at invocation time rather than a fixed reviewed version. In a financial-trading skill with wallet creation, transfers, withdrawals, and credential handling, a compromised or malicious package update could immediately gain code execution and manipulate funds or exfiltrate stored API tokens.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This command uses an unpinned npx package version, enabling remote code execution from whatever version is current at runtime. Because the command participates in wallet creation and credential provisioning, a supply-chain compromise could alter onboarding flows, steal claim URLs or API keys, or create attacker-controlled wallets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Running npx @vincentai/cli without an exact pinned version allows the executed code to change over time outside the skill author's review. In this context, the command triggers balance checks and Safe deployment behavior, so malicious package code could abuse persisted credentials or misdirect asset operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: A skill framed as Polymarket trading also exposes generic wallet transfer-between, token conversion, and cross-chain bridging capabilities. That broadens the blast radius well beyond market bets and enables asset movement primitives that may be triggered under a narrower user expectation, increasing the chance of misuse or prompt-induced financial operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This transfer-related command pulls executable code dynamically with npx, creating a supply-chain risk directly in a funds movement path. If the package were compromised, an attacker could tamper with previewed parameters, recipient routing, or token conversion logic and potentially facilitate asset loss.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The execute-transfer command relies on an unpinned package fetched at runtime, which is especially dangerous because it can initiate cross-chain asset movement. In a compromise scenario, the fetched code could modify destination details, exfiltrate stored credentials, or execute unintended wallet actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Market-browsing commands still invoke dynamically resolved code, so even read-oriented operations create a remote-code-execution foothold. In this skill, read commands also have access to local state and stored credentials, so a compromised package could use benign-looking invocations as a credential theft vector.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This market lookup command executes code fetched at runtime, which introduces supply-chain risk even if the command appears informational. Because the environment includes wallet-related state, malicious package code could harvest API tokens or manipulate returned market data to influence later trades.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx without a pinned version allows externally controlled code changes in a workflow that informs trading decisions. An attacker controlling the package distribution could falsify query results or prepare the environment for later fund-moving abuse.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This active-market listing command inherits the same unpinned package execution risk as the other CLI calls. In a trading context, manipulation of discovery results can steer agents toward attacker-favorable markets or hide relevant safeguards while also enabling local credential access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Fetching and executing the CLI at runtime for market detail retrieval creates an unnecessary supply-chain attack surface. Even non-transactional commands can leak stored credentials or poison downstream decision-making with manipulated market metadata.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The orderbook command runs unpinned remote code, which is risky because orderbook data directly influences trade pricing. A compromised client could distort bids and asks to induce unfavorable trades or use the invocation to exfiltrate API credentials from local storage.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This bet-placement command uses an unpinned package version in a direct funds-moving path. Any malicious update to the package can execute arbitrary code, alter trade parameters, or submit unauthorized orders using the locally stored scoped token.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Holdings retrieval uses dynamically fetched code, so it can still expose local credential material or falsify portfolio state. In a financial workflow, inaccurate holdings can drive erroneous sell, redeem, or withdrawal decisions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Open-order inspection is performed via an unpinned package, creating the same supply-chain risk as transaction commands. Malicious code could hide outstanding orders, influencing the agent to place duplicate or conflicting trades while also accessing stored tokens.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This filtered open-orders command executes remote package code without version pinning. That allows a compromised dependency to tamper with visibility into active orders and potentially set up later loss-causing actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Trade-history retrieval via unpinned npx is a real supply-chain risk because the command runs arbitrary current package code in a credential-bearing environment. Even if primarily informational, the command can be abused for credential theft or to falsify audit history presented to users.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Cancel-order functionality is transaction-affecting and is implemented through a runtime-fetched unpinned package. A malicious update could cancel legitimate protective orders, submit different actions under the hood, or use the stored API key to manipulate positions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Cancel-all commands are especially sensitive because they can remove all standing protections or exit strategies, yet the skill executes them through unpinned runtime package code. Supply-chain compromise here could amplify impact across all orders in the wallet.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Redeem operations affect settlement of positions and use code fetched dynamically at runtime. If the package is compromised, the attacker could manipulate redemption flows, conceal failures, or leverage the stored scoped token for other wallet actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Specific-market redemption via an unpinned npx package exposes a transaction path to supply-chain compromise. Because these commands act on wallet assets, malicious code could submit altered condition IDs or perform unrelated unauthorized operations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.