Security audit

Polymarket Edge

Security checks for vulnerabilities and agentic risk

Overview

This skill fits its Polymarket trading and billing theme, but it exposes billing and auto-trader controls without real authentication and includes a hardcoded billing API key fallback.

Review before installing. Use only behind authenticated access, rotate and remove the embedded SkillPay key, pin dependencies, bind the server locally or behind a protected proxy, and do not enable live trading or provide a private key unless the deployment has verified user identity, explicit trade confirmations, owner-scoped auto-trader controls, spending limits, and a dedicated low-balance wallet.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: billing.py:17
Finding: Hardcoded SkillPay API Credential Is Used as a Runtime Fallback
Content: View full analysis
dict: return { "X-API-Key": os.environ.get("SKILL_BILLING_API_KEY", API_KEY), "Content-Type": "application/json", } ``` ### Technical Analysis A live-looking SkillPay API key is embedded directly in the source code as the fallback value for `SKILL_BILLING_API_KEY`. If the environment variable is absent, `_get_headers()` automatically places this credential in the `X-API-Key` header of requests sent to the SkillPay billing service. Secrets committed to source code should be treated as compromised because anyone with access to the project package, repository history, deployment image, or distributed Skill can retrieve them. The environment-variable override does not mitigate exposure of the committed fallback value. ### Attack Path 1. An attacker downloads or otherwise obtains the Skill source package. 2. The attacker reads `billing.py` and extracts the embedded API key and Skill ID. 3. The attacker submits direct requests to the documented SkillPay billing endpoints using the exposed value in the `X-API-Key` header. 4. Any billing capabilities granted to that credential may be exercised outside the intended Skill deployment. 5. Requests made with the shared credential become difficult to attribute to the legitimate deployment versus an attacker. ### Impact Assessment The attacker may obtain the billing-service privileges assigned to the exposed API key. Depending on server-side authorization enforced by SkillPay, this could include querying billing information, generating payment link ...[truncated 272 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: main.py:65
Finding: Caller-Controlled User Identity Permits Billing Abuse and Unauthorized Global Auto-Trader Control
Content: View full analysis
Optional[JSONResponse]: """Charge 1 token. Return 402 response if balance is zero.""" result = await billing.charge_user(user_id) ``` ```python @app.get("/balance", tags=["Billing"]) async def get_balance(user_id: str = Query(..., description="Your SkillPay user ID")): balance = await billing.get_balance(user_id) return {"user_id": user_id, "balance": balance, "unit": "tokens", "usdt_equivalent": balance / 1000} ``` ```python async def charge_user(user_id: str) -> ChargeResult: """Deduct 1 token from user. Returns ok=False + payment_url if balance is zero.""" async with httpx.AsyncClient(timeout=10) as client: resp = await client.post( f"{BILLING_URL}/charge", headers=_get_headers(), json={"user_id": user_id, "skill_id": SKILL_ID, "amount": 0.001}, ) ``` ```python @app.post("/autotrader/start", tags=["Auto Trader"]) async def autotrader_start( background_tasks: BackgroundTasks, user_id: str = Query(...), interval_seconds: int = Query(300, ge=60, description="Check interval in seconds (min 60)"), auto_trade: bool = Query(False, description="Enable live order placement"), ): """Start the 5-minute BTC auto-trader in the background.""" if err := await _charge_or_reject(user_id): return err if strat.is_running(): return JSONResponse(status_code=409, content={"error": "Auto-trader is already running."}) cfg = StrategyConfig(auto_trade=auto_trade) background_tasks.add_task(strat.auto_trade_loop, interval_seconds, cfg) ``` ```python if __name__ == "__main__": import uvicorn uvicorn.run("main:app", host="0.0.0.0", po ...[truncated 2763 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unbounded Dependency Constraints Create Non-Reproducible and Unsafe Installations
Content: View full analysis
=0.111.0 uvicorn[standard]>=0.29.0 httpx>=0.27.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis All runtime dependencies use open-ended minimum-version constraints. There is no upper bound, exact version pin, lockfile, or package hash. A fresh installation can therefore resolve to a materially different dependency set from the one originally reviewed. This does not prove that any currently named package is malicious. The security issue is that future releases or a compromised package-index response can alter code executed during installation and runtime without any corresponding change to this project. The optional `py-clob-client` dependency is commented out and is not installed by the supplied requirements file. ### Attack Path 1. A maintainer, deployment system, or user follows the documented installation command. 2. The package resolver selects the newest versions satisfying the open-ended constraints. 3. A newly released, compromised, or incompatible dependency version is downloaded from the configured package index. 4. Dependency installation or runtime imports execute code that was not part of the audited dependency set. 5. The deployment may inherit new vulnerabilities, malicious behavior, or breaking security changes without a modification to this repository. ### Impact Assessment Potential impact includes non-reproducible builds, unexpected runtime behavior, exposure to newly introduced dependency vulnerabilities, and supply-chain compromise if an accepted package release or package source is compromised. The resulting code executes with the same operating-system privileges as the Skill process and may access environment variables available to that process, including configured billing ...[truncated 26 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (21)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 13)May include surrounding context.
bash
cd polymarket-edge cp .env.example .env # edit SKILL_BILLING_API_KEY if needed pip install -r requirements.txt python main.py # starts on http://localhost:8080

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · README.md (reported line 13)May include surrounding context.
bash
cd polymarket-edge cp .env.example .env # edit SKILL_BILLING_API_KEY if needed pip install -r requirements.txt python main.py # starts on http://localhost:8080

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description centers on Polymarket trading/analysis features and mentions billing only as a secondary per-call monetization detail. However, the supplied code chunk does not implement any trading, market analysis, strategy logic, portfolio handling, or Polymarket integration at all. Its sole purpose is billing enforcement through SkillPay.me APIs. While billing support is consistent with the description, the primary behavior of this code chunk is materially different from the declared main functionality, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description promises a strategy-driven trading and analysis skill centered on a 5-minute BTC EMA crossover system, plus live auto-trader controls and billing integration. The code chunk only provides a general Polymarket API client for market data retrieval and portfolio lookup, with unimplemented placeholders for authenticated trading. This is a material description/behavior mismatch because key advertised capabilities—strategy execution, signal generation, automation management, and billing—are absent from the actual code. The market browsing, order book, and portfolio-reading portions do align, but they represent only a subset of the declared functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code substantially matches the core declared purpose: a 5-minute BTC EMA crossover strategy for Polymarket with market analysis, signal generation, and optional live auto-trading. It fetches BTC markets, evaluates liquidity and price bounds, computes EMA crossover signals, can place trades, and supports an auto-trader loop. However, the description also claims capabilities not present in this code chunk: reading order books, viewing portfolio positions, and per-call SkillPay.me billing. Additionally, get_order_book is imported but unused, reinforcing that order-book functionality is not actually implemented here. Because the declared description includes several concrete capabilities absent from the supplied code, this should be flagged as a mismatch, even though the primary trading-strategy purpose is aligned.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The decorator automatically bills before executing the handler and silently falls back to charging the literal account 'anonymous' when user_id is absent. In a skill that is billed per call, this makes accidental or unauthorized charging more plausible, especially if routes forget to require or validate user identity, and it provides no built-in confirmation or safeguard at the enforcement point.
Content: No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README actively instructs users to enable autonomous live trading with a private key and auto-trader, but it provides only minimal warning and does not clearly explain the risk of real financial loss, unintended order execution, market volatility, or the consequences of unattended operation. In a trading skill, this omission is security-relevant because users may authorize irreversible actions by an agent without understanding the operational and financial risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises access to environment variables and clearly depends on networked APIs, but it does not declare any explicit tool scope or allowed-tools/permissions boundary. That weakens sandboxing and review because the runtime may grant broader capabilities than users or platforms expect, which is especially risky for a trading skill that can access API keys and potentially a private key.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This function performs a safety-relevant remote billing action by sending the user's identifier and charging their balance, but the only disclosure is an internal docstring for developers. There is no user-facing log, prompt, or confirmation at the point of execution to warn that a billable action is occurring.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The /signal endpoint allows callers to set auto_trade=true, which can trigger real order placement using server-side trading credentials without any explicit confirmation step, elevated authorization check, or strong warning about financial loss. In a trading skill, this context makes the issue more dangerous because a normal analytical request can be turned into live execution, increasing the chance of accidental or unauthorized trades.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The /autotrader/start endpoint can launch a persistent background trading loop with auto_trade=true based only on a billed API call, without a strong user-facing warning, proof of account ownership, or explicit execution consent. This is more dangerous in this skill's context because it enables repeated live trades over time, magnifying financial loss from accidental activation, misuse, or abuse of shared server credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file explicitly instructs users to export an EVM wallet private key via an environment variable to enable trading, but it does not include strong in-file warnings about the sensitivity of that credential or safer alternatives. In the context of a trading skill that may execute financial actions, encouraging raw private-key injection increases the chance of secret exposure through shell history, process inspection, logs, misconfiguration, or reuse in broader agent environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code can place real buy orders whenever cfg.auto_trade is enabled and a signal is generated, with no per-trade confirmation, no secondary authorization gate, and only a weak boolean config flag controlling execution. In a trading skill, this is especially dangerous because strategy errors, bad market data, prompt misuse, or accidental configuration changes can directly cause financial loss through unauthorized or unintended trades.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The function makes a network request containing user_id, which transmits user data to an external service. Although this is part of billing functionality, the code provides only a developer docstring and no visible user warning or notice about the external data transmission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This function transmits user_id and payment amount to a remote billing endpoint, which affects user financial workflow and privacy. The code documents the behavior for developers but lacks a user-visible warning or notice that this external billing request is made.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency is specified with a lower bound only (fastapi>=0.111.0), which makes builds non-reproducible and can pull in unexpected future releases or vulnerable transitive versions. In a trading skill that may expose APIs or automate financial actions, uncontrolled dependency drift increases supply-chain and stability risk even if no specific exploit is present today.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
fastapi>=0.111.0 uvicorn[standard]>=0.29.0 httpx>=0.27.0

Unverifiable Dependency: fastapi has 3 known advisory(ies) (CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: FastAPI has known advisories, and because the requirement is not pinned, there is no way to verify from this manifest whether the deployed version is affected. This uncertainty is risky for an API-facing skill, especially one tied to portfolio or order-management actions, because framework flaws could expose endpoints or weaken request protections.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: uvicorn has 4 known advisory(ies) (CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: Uvicorn has published advisories, and the manifest does not constrain an exact safe version, so the installed package could still fall within a vulnerable range. Since this package is part of the public-facing server stack, any affected deployment could expose request/response handling weaknesses or logging-related issues.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: httpx>=0.27.0 is also unpinned, so installations may resolve to different versions over time, including releases with behavioral changes or newly introduced security issues. Because this skill likely makes outbound network calls to market and trading APIs, dependency drift in the HTTP client can directly affect transport security, request handling, or availability.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
fastapi>=0.111.0 uvicorn[standard]>=0.29.0 httpx>=0.27.0 # Optional: for live order placement on Polymarket CLOB # py-clob-client>=0.17.0

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: Httpx has known advisories, and without exact version pinning the manifest cannot demonstrate that only patched versions will be installed. In a market-trading skill that depends on external HTTP APIs, uncertainty in the HTTP client version can create avoidable exposure in request validation or transport behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.