T09 · Insecure Skill Coding Practices
Error
- Location
scripts/monitor.py:24- Finding
Arbitrary Command Execution Through Shell Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
Polymarket Arbitrage
Security checks for vulnerabilities and agentic risk
Overview
This skill is a Polymarket market scanner, but it overstates trading capabilities and contains unsafe command execution and credential-handling patterns users should review before installing.
Review this before installing. Use a virtual environment, pin dependencies, avoid passing untrusted or unusual --data-dir values, and do not put real Telegram or webhook tokens on the command line. Treat the tool as a read-only paper-trading scanner, not an automated trading or execution system.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/monitor.py:81- Finding
Telegram Bot Token Exposure Through Command-Line Arguments and Logging
- Content
View full analysis
/sendMessage?chat_id=" ``` ### Technical Analysis Telegram bot API URLs contain the bot token in the URL path. Supplying that URL as a command-line argument exposes the credential to shell history and potentially to process-inspection tools available to other local users or monitoring software. The monitor then writes the complete URL to standard error. If stderr is redirected, collected by a service manager, captured by CI/CD infrastructure, or forwarded to centralized logging, the token is copied into additional persistent systems. The implementation does not actually send a webhook request. The option only prints the sensitive URL, meaning the credential exposure is unnecessary for the currently implemented functionality and exceeds minimum privilege and data-handling requirements. ### Attack Path 1. A user follows `SKILL.md` and invoke ...[truncated 1192 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:16- Finding
Unpinned Runtime Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description substantially overstates the implemented functionality. The code does match part of the declared purpose: it detects one form of Polymarket arbitrage (math arbitrage) and includes a basic risk score. However, several prominent declared capabilities are absent. There is no market monitoring loop or live data access, no trade execution, no order placement, no alerting, and no P&L tracking. Cross-market arbitrage is explicitly marked TODO and returns an empty list, while orderbook arbitrage is only mentioned in comments/docstring and not implemented at all. The script operates only on a supplied local markets JSON file and produces an output file, so its actual primary purpose is offline math-arbitrage screening rather than a broader monitor-and-execute arbitrage system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a full arbitrage monitoring and execution capability for Polymarket, including several specific analysis modes and operational features. The provided code does not implement any of those core behaviors. It only retrieves the Polymarket homepage, parses visible market-related text from HTML, extracts basic fields such as title, probabilities, and volume strings, filters by minimum volume, deduplicates by market ID, and writes the results to a JSON file. While fetching market data could be a supporting component for an arbitrage system, this chunk by itself does not detect arbitrage, compare markets, inspect orderbooks, execute trades, manage risk, track P&L, or send alerts. Therefore the actual behavior is materially narrower and different from the declared purpose.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Using shell=True in a tool-like monitoring script materially increases abuse risk because this skill accepts runtime parameters such as --data-dir and --min-edge that flow into command strings. In this context, an attacker or unsafe caller could supply crafted values to break out of the intended command and run arbitrary shell commands, compromising the host running the trading monitor.
- Content
python print(f"[{datetime.now().strftime('%H:%M:%S')}] {description}", file=sys.stderr) try: result = subprocess.run( cmd, shell=True, capture_output=True,
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documentation describes capabilities that inherently use network, shell, and file read/write behaviors, but it does not declare any explicit tool scope or permissions boundary. This creates a governance and least-privilege problem: an agent may invoke the skill without clear authorization constraints, increasing the chance of unintended file modification, command execution, or outbound requests.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description says the skill will 'monitor and execute arbitrage opportunities' and includes trading strategies, risk management, and P&L tracking. However, the file repeatedly describes only market scraping, arbitrage detection, monitoring, deduplicated alerting, and saving JSON outputs, while explicitly stating automation/execution is a future phase and that current trading should remain manual.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest states the skill detects 'cross-market arbitrage' and 'orderbook inefficiencies' as present capabilities. In contrast, the documentation says cross-market arbitrage is 'not yet implemented' and orderbook arbitrage requires real-time orderbook data that the current source does not provide, indicating the advertised behavior exceeds actual functionality.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
The skill supports sending alerts to an arbitrary webhook URL, with the example using Telegram's bot API. Outbound transmission can leak market data, operational metadata, or secrets embedded in URLs, and if the webhook target is user-controlled or misconfigured it becomes an exfiltration channel.
- Content
Pass webhook URL to monitor script for alerts:
bash python scripts/monitor.py --alert-webhook "https://api.telegram.org/bot<token>/sendMessage?chat_id=<id>"Position Sizing
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring claims support for math, cross-market, and orderbook arbitrage, but the implementation only performs math arbitrage detection. In a trading skill, this can mislead users or downstream agents into believing broader coverage exists, causing missed risk checks and incorrect trading decisions based on incomplete analysis.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code advertises cross-market arbitrage detection, but the corresponding function is a TODO stub that always returns an empty list. In this skill context, silent non-detection is dangerous because users may rely on the tool for automated market monitoring or trading and assume an important class of opportunities or inconsistencies is being checked.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The code executes shell commands with subprocess.run(..., shell=True) using command strings built from variables such as script paths, output file paths, and user-controlled CLI arguments. If any of those values contain shell metacharacters, an attacker could achieve command injection and execute arbitrary commands with the privileges of the monitoring process.
- Content
python print(f"[{datetime.now().strftime('%H:%M:%S')}] {description}", file=sys.stderr) try: result = subprocess.run( cmd, shell=True, capture_output=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code file invokes shell commands using subprocess.run with shell=True, which is a safety-relevant operation under the audit criteria. Although progress messages are printed, there is no explicit disclosure in the function docstring or surrounding comments that the skill will execute external scripts/commands on the user's system.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest says the skill includes 'P&L tracking,' which implies recording realized or hypothetical profit/loss over time. The documented files and workflow mention markets.json, arbs.json, and alert_state.json, plus manual spreadsheet tracking by the user, but no built-in P&L ledger or tracking mechanism is described.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The function docstring says "Send alert for arbitrage opportunity," and the CLI exposes an
--alert-webhookoption, but when a webhook URL is provided the implementation merely prints "Would send to webhook" and performs no network delivery. This is an intent-code divergence because the inline documentation and interface imply actual alert dispatch while the code only emits local stderr output.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This file creates a data directory and persists markets, arbitrage results, and alert state, which affects user data on disk. While the top-level docstring mentions 'Persistence of results,' it does not clearly disclose what files are written or that alert history is retained, so the storage behavior is only partially described.
- Content
Static analysis
No suspicious patterns detected.