Nash0 Polymarket CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:57 AM UTC
• Version: 0.1.0

Overview

This Polymarket helper is mostly coherent, but it treats API-key listing as safe even though that may expose account credentials.

Install only if you are comfortable with an agent helping operate a financial trading CLI. Before use, treat any API-key listing, wallet-management, approval, order placement, or cancellation command as sensitive and require explicit confirmation; do not let the agent display private keys, API secrets, passphrases, or complete credential responses.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/command-map.md:100

Finding

Authenticated API Key Enumeration Is Incorrectly Classified as Safe

Content

View full analysis

Vulnerability Details

File Location: references/command-map.md, line 100
Vulnerability Type: Sensitive credential disclosure through agent-visible command output
Risk Level: High

Vulnerable Code

bash

polymarket clob api-keys

The command appears under the section titled “Read-only but wallet-aware”, whose contents are presented as commands that may be run without the explicit confirmation required for sensitive operations.

Technical Analysis

The polymarket clob api-keys command enumerates API-key information associated with the locally configured Polymarket account. Although it may not modify account state, read-only behavior does not make credential-related output safe. Depending on the CLI response, the output could include API credentials, identifiers, secrets, passphrases, or other authentication metadata.

Executing this command may cause the CLI to authenticate using credentials sourced from the local environment or Polymarket configuration. Its output then becomes visible to the agent and may be retained in tool results, conversation transcripts, application logs, telemetry, or debugging records. This exceeds the minimum privileges needed for ordinary market research and account-status inspection.

The main skill states that authenticated read-only commands are allowed only when they do not reveal secrets. Classifying API-key enumeration as generally safe conflicts with that restriction and can lead the agent to expose credential material without informed user approval.

Attack Path

1. A user or injected instruction asks the agent to inspect the configured Polymarket account or troubleshoot API access.
2. The agent consults references/command-map.md.
3. Because polymarket clob api-keys is listed in the read-only, wallet-aware section rather than the sensitive section, the agent runs it without explicit confirmation.
4. The CLI reads local authentication material and queri ...[truncated 1245 chars]

Remediation

View remediation

Remediation Suggestions

1. Move polymarket clob api-keys from the read-only wallet-aware list into the sensitive-command section.
2. Require explicit, purpose-specific user confirmation immediately before executing any API-key enumeration command.
3. Prefer directing the user to run this command locally rather than allowing the agent to execute it.
4. Add an explicit rule that the agent must never reproduce API secrets, passphrases, private keys, bearer tokens, or complete authentication responses.
5. If execution is unavoidable, first verify the installed CLI version and documented output schema, then filter the output locally so only non-secret metadata—such as a redacted key identifier or creation date—is retained.
6. Avoid using generic JSON output for credential-management commands because structured output can make complete secrets easier to capture in logs.
7. Treat API-key creation, listing, and deletion as one sensitive credential-management group requiring confirmation and output redaction.
8. Add a post-execution check that prevents credential-like values from being included in assistant responses, transcripts, or diagnostic logs.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/command-map.md (reported line 114)May include surrounding context.

bash

polymarket setup
polymarket wallet create
polymarket wallet create --force
polymarket wallet import 0xPRIVATE_KEY
polymarket wallet address