Polymarket Scout — Hourly Edge Detector

• Outcome: Pass
• Latest audit: May 28, 2026 at 5:48 AM UTC
• Version:
  1.0.0

Overview

This is a read-only Polymarket analysis skill that fetches public market data and gives betting-edge estimates without asking for credentials or executing trades.

Install only if you are comfortable with your agent making outbound requests to public Polymarket-related APIs and returning betting suggestions. Treat the Kelly sizing and “edge” output as heuristic gambling/financial analysis, not a guarantee, and do not risk funds without independent verification.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrase "Use polymarket-scout to find best Polymarket bet right now" is broad and conversational enough that it could match ordinary user requests rather than an explicit invocation. In a betting/market-scanning skill, accidental activation can cause the agent to fetch live market data and provide trading recommendations in contexts where the user did not clearly intend to invoke this capability.

VirusTotal

65/65 vendors flagged this skill as clean.