Polymarket Command Center

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  1.1.0

Overview

This is a read-only Polymarket data lookup skill that contacts disclosed public Polymarket APIs and keeps only limited local watchlist state.

Install this if you are comfortable with a read-only market-data tool contacting Polymarket public APIs. Avoid entering private text as market queries or watchlist slugs, and treat the local watchlist file as user-controlled configuration.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill explicitly performs outbound HTTP requests to public Polymarket endpoints but does not declare any corresponding network permission. Undeclared network capability is a real security issue because it weakens user/admin review, breaks least-privilege expectations, and could enable unnoticed data exfiltration or remote content retrieval if the implementation changes.

VirusTotal

66/66 vendors flagged this skill as clean.