Polygon Agents SDK

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:50 AM UTC
• Version: 1.0.0

Overview

Review recommended: the skill is a coherent Polygon wallet toolkit, but it uses high-impact wallet authority with an unpinned global install, automatic tunnel binary download, and sensitive session material handling that need user scrutiny.

Install only if you are comfortable giving this CLI wallet-session authority and accepting the supply-chain and network exposure. Prefer a pinned/audited version, avoid global installs where possible, review cloudflared download and tunnel behavior before creating wallets, set narrow session limits, use dry-runs before --broadcast, and clean up any /tmp session files immediately after use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:9

Finding

Unpinned Global Installation from a Mutable GitHub Source

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:137

Finding

Automatic Download and Execution of an Unverified Cloudflared Binary

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:137

Finding

Sensitive Wallet Session Callback Traverses a Public Quick Tunnel

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:151

Finding

Wallet Session Ciphertext Stored in a Predictable Shared Temporary Path

Content

View full analysis

.txt` for reference. To import later: ``` ```text polygon-agent wallet import --ciphertext @/tmp/polygon-session-.txt ``` ### Technical Analysis The manual fallback automatically stores encrypted wallet-session material in the system-wide temporary directory using a predictable naming pattern based on a request identifier. The documentation does not state that the file is created atomically, uses mode `0600`, rejects symbolic links, resides in a user-private directory, or is deleted after use. Although the blob is encrypted, it remains sensitive authorization material intended for later import. Encryption does not eliminate risks from offline theft, replay, metadata exposure, file replacement, or weaknesses in key management. On multi-user systems, unsafe creation of a predictable `/tmp` path can introduce: - Unauthorized local reading if permissions are too broad. - Symbolic-link or race-condition attacks if the file is opened without exclusive and no-follow protections. - Session substitution if an attacker can replace the file before import. - Long-term exposure because no cleanup procedure is documented. The source implementation is absent, so actual file permissions and creation flags cannot be verified. The documented automatic persistence in a shared temporary directory is nevertheless an avoidable least-privilege weakness. ### Attack Path 1. A user initiates manual wallet approval, causing the session ciphertext to be written under `/tmp`. 2. A local attacker monitors the directory or predicts/discovers the request identifier. 3. If file permissions are permissive, the attacker copies the encrypted session blob for later analysis or replay. 4. If creation or import ...[truncated 1162 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · QUICKSTART.md (reported line 3)May include surrounding context.

md

---
name: polygon-agent-kit-quickstart
description: Quick start guide for Polygon Agent Kit. Get project access key, create wallet with session permissions, register agent onchain, perform token operations. Context-efficient workflow for autonomous agents.
---

# Polygon Agent Kit - Quick Start

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quickstart instructs the CLI to auto-download and execute cloudflared and establish a public *.trycloudflare.com callback tunnel, but this network-exposed behavior is not clearly disclosed in the stated toolkit scope. Auto-fetching and running external binaries increases supply-chain and remote exposure risk, and the public callback URL handles wallet-session approval material, making the capability materially security-relevant in an agent wallet context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quickstart states that the encrypted session blob is automatically written to /tmp, which is inconsistent with the claim that credentials are stored under AES-256-GCM-encrypted storage in ~/.polygon-agent/. Even if encrypted, placing sensitive session material in a world-accessible temporary location can expose it to local users, malware, backup tooling, or accidental disclosure, especially if file permissions and cleanup are not tightly controlled.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill advertises AES-256-GCM encrypted storage in the metadata, but later documents a manual fallback that saves encrypted session blobs to /tmp. Even if the blob is encrypted, storing sensitive session material in a world-accessible or weakly controlled temporary location without a warning creates exposure risk and makes the top-level security claim incomplete and potentially misleading.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

## Key Behaviors

- **Dry-run by default** — all write commands require `--broadcast` to execute
- **Smart defaults** — `--wallet main`, `--chain polygon`, auto-wait on `wallet create`
- **Fee preference** — auto-selects USDC over native POL when both available
- **`fund`** — reads `walletAddress` from the wallet session and sets it as `toAddress` in the Trails widget URL. Always run `polygon-agent fund` to get the correct URL — never construct it manually or hardcode any address. The returned JSON contains `fundingUrl` and `walletAddress` so you can confirm the pre-filled recipient before sharing.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly states that wallet create will auto-download and execute cloudflared and expose a local callback endpoint via a Cloudflare Quick Tunnel. Auto-fetching and running a network-facing binary materially expands the trust boundary and attack surface, especially in an agent toolkit handling wallet/session material. In this context, the behavior is more dangerous because it is tied to approval of crypto wallet sessions and can affect both host security and sensitive session flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation describes automatic download of cloudflared and creation of a public tunnel, but does not prominently warn about the privacy, network exposure, and host-impact implications of that action. Users may unknowingly permit execution of external software and public exposure of a local callback path in a security-sensitive wallet workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manual fallback saves encrypted session material to /tmp/polygon-session-<rid>.txt without a clear warning about local exposure, persistence, or cleanup. Temporary directories are commonly monitored, shared across processes, or left uncleared, so sensitive wallet-session artifacts can be recovered or mishandled even if encrypted.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.