ClawHub
Back to skill

Security audit

Polymarket CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent with Polymarket use, but it exposes users to real trading, wallet, credential, and persistent profiling risks that need careful review before installation.

Install only if you are comfortable with an agent-assisted workflow around real Polymarket trading. Keep use read-only unless you explicitly want trading, do not paste private keys into command-line arguments or chat, review every order or on-chain transaction before approving it, and consider limiting or deleting the persistent memory file if you do not want trading interests and behavior retained.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
setup.md:29
Finding

Wallet Private Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: setup.md:29-34; commands.md:269-280
Vulnerability Type: Private key exposure through process arguments and shell history
Risk Level: High

Vulnerable Code

setup.md:29-34:

markdown
If they want to trade, guide them to set up their wallet themselves:
1. They run `polymarket wallet create` or `polymarket wallet import KEY` directly
2. Remind them about MATIC for gas on Polygon
3. They run `polymarket approve set` before first trade
4. Emphasize: the agent never handles private keys — wallet setup is done by the user directly

commands.md:269-280:

markdown
## Wallet Management (USER-ONLY — agent must not run these)

These commands handle private keys. The user must run them directly:

```bash
polymarket wallet create          # Generate new
polymarket wallet create --force  # Overwrite existing
polymarket wallet import 0xKEY    # Import existing
polymarket wallet address         # Print address
polymarket wallet show            # Full info (may reveal sensitive data)
polymarket wallet reset           # Delete config (prompts)
polymarket wallet reset --force   # Delete without prompt
text

### Technical Analysis

The documented wallet-import procedure places a private key directly in a command-line argument. Command arguments can be exposed through shell history, terminal session logging, process inspection facilities, endpoint monitoring products, audit logs, crash diagnostics, and copied command transcripts.

Restricting execution to the user does not eliminate this vulnerability. The sensitive value is still supplied to the shell and operating system as plaintext. Depending on system configuration and timing, another local process or account may be able to inspect it while the command is running or retrieve it later from persistent history and logs.

### Attack Path

1. A user follows the documented `polymarket wallet import
...[truncated 1101 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove every example that places a private key directly in a command-line argument.
  • Require an interactive wallet-import flow that reads the secret from a hidden terminal prompt.
  • If supported by the CLI, accept the secret through a protected file descriptor or another mechanism that does not expose it in process arguments.
  • Prefer hardware wallets or external signing mechanisms so raw private keys never enter the CLI environment.
  • Explicitly warn users not to paste private keys into commands, scripts, environment variables, chat messages, or unencrypted files.
  • Document secure permissions for any unavoidable temporary secret material and ensure it is deleted immediately after use.
  • Advise users who previously followed the documented command to clear relevant history and logs and, because deletion may be incomplete, migrate assets to a newly generated wallet.

T08 · Insecure Dependencies

Warning
Location
commands.md:3
Finding

Unpinned Executable Dependencies Allow Supply-Chain Substitution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:7; commands.md:3-15
Vulnerability Type: Mutable and unverified third-party executable dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:7:

yaml
metadata: {"clawdbot":{"emoji":"📊","requires":{"bins":["polymarket"]},"install":[{"id":"brew","kind":"brew","formula":"polymarket","tap":"Polymarket/polymarket-cli","bins":["polymarket"],"label":"Install Polymarket CLI (Homebrew)"},{"id":"cargo","kind":"cargo","crate":"polymarket-cli","bins":["polymarket"],"label":"Install via Cargo (Rust)"}],"os":["linux","darwin"]}}

commands.md:3-15:

markdown
## Installation

```bash
# Homebrew (macOS/Linux) — recommended
brew tap Polymarket/polymarket-cli https://github.com/Polymarket/polymarket-cli
brew install polymarket

# Cargo (Rust)
cargo install polymarket-cli

# From source
git clone https://github.com/Polymarket/polymarket-cli
cd polymarket-cli && cargo install --path .
text

### Technical Analysis

All documented installation paths retrieve executable content from mutable upstream sources without pinning a reviewed release, package version, commit hash, checksum, or cryptographic signature.

`cargo install polymarket-cli` resolves the package version available at installation time. The Homebrew installation resolves the current formula and artifacts from the configured tap. The source installation clones the repository's current default branch. Consequently, the code executed by future users can differ from the code that existed when this Skill was audited.

This is an unsafe supply-chain practice rather than proof that the named upstream project is currently malicious. Exploitation requires compromise or unauthorized modification of an upstream package, repository, release artifact, tap, maintainer account, or distribution channel.

### Attack Path

1. An attacker compromises an upstream maintainer account, packag
...[truncated 1368 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the Cargo installation to a specific reviewed version using the package manager's version controls.
  • Pin source installations to an immutable reviewed commit or signed release tag instead of cloning and building the current default branch.
  • Publish expected SHA-256 or stronger hashes for downloaded release artifacts and require verification before installation.
  • Verify release signatures and clearly identify the expected signing identity and official publisher.
  • Pin or otherwise validate the Homebrew formula and downloaded artifact rather than implicitly trusting the latest tap state.
  • Record the reviewed dependency version in SKILL.md so automated installers and manual instructions use the same release.
  • Re-audit dependency updates before changing the pinned version.
  • Avoid automatic CLI upgrades unless the new release is authenticated and has undergone equivalent review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This section includes live trading and destructive account actions such as order placement and broad cancellation without strong warnings, confirmation requirements, or clear statements of financial consequence. In an autonomous-agent context, these commands can cause unintended trades, liquidation of strategy, or mass cancellation of orders from ambiguous or manipulated prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

API key creation and deletion are credential-management operations, but the documentation presents them like routine read-only commands. In an agent environment, this can lead to unauthorized credential issuance, deletion of working access, or exposure of account control mechanisms that could be abused by prompt injection or operator error.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Approval, split/merge, and redeem commands trigger on-chain transactions affecting token permissions and asset balances, yet the documentation does not prominently warn about gas costs, approvals, or irreversible asset effects. In a trading-agent skill, this is especially dangerous because blanket approvals or token transformations can materially change wallet exposure and create lasting risk if executed unintentionally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Although the documentation says wallet management is USER-ONLY, it still enumerates directly executable commands for private-key import, wallet display, forced overwrite, and forced reset. In an agent setting, exposing these commands in the skill increases the chance that another prompt or tool-use path invokes sensitive wallet operations, leading to key disclosure, wallet replacement, or irreversible loss of access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The template explicitly instructs creation and ongoing maintenance of a persistent memory file containing user context, market interests, trading patterns, and risk tolerance, but provides no data-minimization, consent, retention, or sensitivity guidance. In a financial/trading context, these behavioral notes can become sensitive profiling data and may be stored longer than necessary or without the user's awareness.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template directs the agent to retain conversation-derived observations and behavioral patterns such as favorite categories, trading patterns, and market interests. This creates a persistent user profile from financial behavior, which increases privacy risk and could enable overcollection, unwanted inference, or misuse if the file is accessed by other tools or operators.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instruction to activate whenever 'prediction markets come up' is an overly broad trigger that can cause the skill to engage in contexts the user did not specifically request. Because this skill can influence financial decisions and potentially lead toward trading workflows, broad auto-activation increases the risk of unwanted monitoring, unsolicited prompts, or action in sensitive contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill directs storage of activation preferences, use cases, tracked markets, and trading preferences in persistent memory without a clear warning that this data will be retained. In a financial context, these preferences can reveal interests, strategies, and potentially sensitive behavioral signals, creating privacy and profiling risks if stored without explicit, informed consent and retention boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.