Polymarket CLI & Arb Scanner

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:25 AM UTC
• Version: 1.1.0

Overview

This Polymarket trading skill is useful and mostly transparent about its purpose, but it needs Review because it includes unsafe installation paths and a helper script with local command-injection risk.

Install only after reviewing or replacing the installer with pinned, verified CLI artifacts. Prefer read-only commands unless you intentionally want an agent to trade, approve contracts, bridge funds, or import wallets. Do not paste real private keys into command lines, and avoid running scripts/expiry-arb.ts with untrusted query text until the shell interpolation is fixed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:7

Finding

Unverified Remote Installation Scripts Are Executed Directly by a Shell

Content

View full analysis

/dev/null; then ``` `scripts/install.sh:19`: ```bash curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y ``` ### Technical Analysis These commands download scripts from external URLs and pass the responses directly to a shell. The downloaded content is executed before it can be inspected, and no cryptographic signature, checksum, immutable commit, or release version is verified. The Polymarket installer URL follows the mutable `main` branch. Consequently, the effective code executed by this Skill can change after the reviewed package has been published. HTTPS protects the connection in transit but does not protect against compromise of the upstream repository, hosting account, release process, or authorized publisher credentials. The Rust installer is retrieved from a recognized project domain and explicitly requires HTTPS and TLS 1.2, but it still has the same execute-before-verification weakness. This behavior exceeds the minimum privileges required for read-only market browsing and price analysis. Installation should be an explicit, independently verified prerequisite rather than an automatic remote-code execution path. ### Attack Path 1. A user or Agent follows the prerequisite instructions or runs `scripts/install.sh`. 2. The shell retrieves the current response from the external installer URL. 3. An attacker compromises the upstream repository, hosting account, publishing process, or another trusted component controlling the response. 4. The attacker replac ...[truncated 992 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:23

Finding

Mutable and Unverified Upstream Source Is Built and Installed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/expiry-arb.ts:58

Finding

User-Controlled Market Query Allows Shell Command Injection

Content

View full analysis

/dev/null; polymarket -o json markets search "${query}" --limit 200`, { encoding: "utf-8", shell: "/bin/bash", maxBuffer: 50 * 1024 * 1024 } ); ``` ### Technical Analysis The script accepts a command-line argument and embeds it directly into a command string evaluated by `/bin/bash`. Surrounding the value with double quotes does not make it safe. An attacker can provide a quote to terminate the intended argument or use command substitutions such as `$(...)` or backticks, which Bash evaluates even inside double quotes. The use of a shell is unnecessary because the program only needs to invoke `polymarket` with discrete arguments. This coding pattern converts ordinary market-search text into executable shell syntax. For example, a crafted query containing command substitution can cause the substituted command to execute while Bash constructs the argument passed to `polymarket`. Exploitation does not require control over the Polymarket service; it only requires influence over the local query supplied to this script. ### Attack Path 1. An attacker persuades a user or Agent to scan a specially crafted “market query,” or otherwise controls the argument supplied to `expiry-arb.ts`. 2. The argument is stored in `query` without shell-safe handling. 3. The script constructs a command string containing that value. 4. `execSync` invokes `/bin/bash` because `shell: "/bin/bash"` is configured. 5. Bash interprets attacker-supplied command substitution, quoting, or metacharacters. 6. The injected local command executes with the privileges and envir ...[truncated 617 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/expiry-arb.ts:1

Finding

Unpinned npx Launcher Can Retrieve and Execute a Package at Runtime

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (13)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Using 'curl ... | sh' chains network retrieval directly into shell execution, eliminating any inspection or verification step before running code. In the context of a financial trading skill that can later manage wallets and approvals, compromise of the install path could lead to full command execution, credential theft, malicious transaction signing, or fund loss.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Binary must be installed. If missing:

bash

curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh
# Or build from source:
# cargo install --path /tmp/polymarket-cli

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script interpolates the user-controlled query directly into a Bash command passed to execSync(..., { shell: '/bin/bash' }). Because the query is placed inside double quotes, shell metacharacters such as command substitution ($(...)), backticks, or quote-breaking payloads can trigger arbitrary command execution on the host running the skill, which is far more dangerous than the stated market-scanning purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example polymarket wallet import 0xYOUR_PRIVATE_KEY normalizes entering a raw private key directly on the command line without any adjacent warning about shell history, process inspection, clipboard leakage, or safer alternatives. In a trading skill that explicitly handles wallets and real assets, this can lead users to expose credentials that would allow full theft of funds and account control.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill invokes shell commands extensively, including installation, wallet management, and trading operations, but does not declare any tool restrictions such as allowed-tools or permissions. That creates an unnecessarily broad execution surface and makes it easier for an agent runtime to permit risky shell actions beyond the minimum needed for the skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs users to create/import wallets and states that configuration is stored in ~/.config/polymarket/config.json, indicating session or credential persistence on disk. In a multi-tool or shared environment, persisted wallet material or auth state can be reused by later sessions or other processes, leading to unauthorized trading or exposure of sensitive keys.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash

polymarket setup                    # Interactive wizard
# Or manually:
polymarket wallet create            # New wallet
polymarket wallet import 0xKEY...   # Import existing
polymarket approve set              # Approve contracts (needs MATIC)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents order placement, cancellations, approvals, wallet creation/import, bridging, and on-chain token operations without prominent warnings that these actions can move funds, grant token allowances, or cause irreversible blockchain transactions. In an agent setting, this increases the risk of a user or automated workflow triggering real financial loss or unintended approvals without informed confirmation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Beyond the injection issue, the skill executes a shell using untrusted input without any clear disclosure to the user that a free-form search term will be fed into Bash. In the context of an agent skill for browsing and trading Polymarket, this mismatch increases risk because a seemingly harmless market-search request could lead to arbitrary local command execution if the input is attacker-influenced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The installer executes remote scripts directly from the network via shell piping, both for the Polymarket CLI bootstrapper and for rustup, without pinning versions, verifying checksums/signatures, or requiring user confirmation. If the upstream content, GitHub path, DNS/TLS trust chain, or distribution channel is compromised, arbitrary code will run immediately on the host during installation.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The skill recommends fetching and executing an installation script directly from a remote GitHub URL. This creates a supply-chain risk because the fetched script can change over time or be tampered with, and the agent/user is instructed to trust and run it immediately.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Binary must be installed. If missing:

bash

curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh
# Or build from source:
# cargo install --path /tmp/polymarket-cli

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This line fetches an installer script from a mutable GitHub branch URL and executes it immediately with sh. That creates a direct remote code execution path during setup, and because it uses a branch reference rather than a pinned immutable artifact, the executed code can change over time without review.

Content

Scanner excerpt · scripts/install.sh (reported line 7)May include surrounding context.

sh

echo "Installing Polymarket CLI..."

# Try pre-built binary first
if curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh 2>/dev/null; then
  # Verify it works (GLIBC compatibility)
  if polymarket --version 2>/dev/null; then
    echo "✅ Polymarket CLI installed (pre-built)"

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Although rustup is a common legitimate installer, piping it directly into sh still executes unaudited remote code at install time. The risk is somewhat reduced by HTTPS and the widespread use of rustup, but compromise of the distribution endpoint or trust chain would still lead to arbitrary code execution.

Content

Scanner excerpt · scripts/install.sh (reported line 19)May include surrounding context.

sh

# Build from source
if ! command -v cargo &>/dev/null; then
  echo "Installing Rust..."
  curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
  source "$HOME/.cargo/env"
fi