Polymarket CLI Trading

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:35 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for Polymarket trading, but it documents an unsafe pipe-to-shell installer and weak private-key handling guidance in a real-money wallet context.

Use the Homebrew or reviewed source-build installation path instead of the `curl | sh` command. Do not pass wallet private keys on the command line, avoid exposing them in environment variables or logs, use a dedicated low-balance trading wallet, review approvals carefully, and require explicit confirmation before any trade, approval, cancellation, redemption, wallet reset, or API-key mutation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:33
• Finding: Unpinned Remote Installation Script Executed Directly by Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:33` **Vulnerability Type**: T03: Remote Payload Retrieval and Execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh ``` ### Technical Analysis This instruction downloads a shell script from the mutable `main` branch of an external GitHub repository and immediately executes it. The payload is not pinned to an immutable commit or release, and the command performs no checksum or digital-signature verification. Even though the URL refers to the stated Polymarket organization, the effective code can change after this Skill has been reviewed. Compromise of the upstream repository, maintainer account, release process, or network trust chain could therefore turn the installation command into an arbitrary-code execution mechanism. Piping directly into `sh` also prevents meaningful inspection before execution. This behavior is not necessary for the declared functionality because the document already provides Homebrew and source-build installation methods. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the branch publication process. 2. The attacker modifies `install.sh` on the mutable `main` branch. 3. A user or Agent follows the installation instruction in `SKILL.md`. 4. `curl` retrieves the attacker-controlled script. 5. The pipe passes the response directly to `sh` without review or integrity verification. 6. The script executes arbitrary commands with the privileges of the invoking user. 7. The payload could inspect wallet-related files or environment variables, modify user files, install additional software, or initiate unauthorized network activity. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. The resulting scope includes files, credentials, environment variables, and applicatio ...[truncated 388 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | sh` installation method. 2. Prefer installation from a versioned package-manager release. 3. If a script-based installation must remain: - Pin the URL to an immutable reviewed commit or versioned release. - Download the script to a local file without executing it. - Verify a publisher-provided cryptographic signature or a trusted, hardcoded SHA-256 checksum. - Review the downloaded script before execution. - Execute it as an unprivileged user. 4. Document the expected files, network endpoints, and permissions used by the installer. 5. Avoid silent curl options for security-sensitive installation flows so retrieval and verification failures remain visible. A safer pattern is: ```bash curl -fL -o install.sh "https://raw.githubusercontent.com/Polymarket/polymarket-cli/<IMMUTABLE_COMMIT>/install.sh" echo "<TRUSTED_SHA256> install.sh" | sha256sum -c - less install.sh sh install.sh ``` ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:33
• Finding: Unpinned Remote Installation Script Repeated in User Documentation<![CDATA[ ## Vulnerability Details **File Location**: `README.md:33` **Vulnerability Type**: T03: Remote Payload Retrieval and Execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh ``` ### Technical Analysis The README recommends executing content fetched from an external, mutable Git branch directly in a shell. No immutable version, checksum, signature, or review step establishes that the downloaded content is the same code that was evaluated when this project was audited. Trust in the current repository owner does not eliminate this supply-chain risk. Future upstream changes or account compromise can alter the executed payload without requiring any modification to this project. Direct remote execution also exceeds the minimum access needed to document or install the CLI because safer Homebrew and source-build options are already present. ### Attack Path 1. The upstream `main` branch or an authorized publishing account is compromised. 2. A malicious actor replaces or modifies the remote `install.sh`. 3. A user copies the README installation command. 4. The response body is streamed directly into `sh`. 5. The attacker's commands execute with the user's local permissions before the user can inspect the payload. 6. The malicious installer may access local wallet configuration, collect credentials, alter user files, or install further payloads. ### Impact Assessment The command creates an arbitrary-code execution channel with the invoking user's privileges. Accessible wallet files, configuration, API credentials, shell data, and other user-owned files could be read or modified. In the context of real-money cryptocurrency trading, compromise may lead to unauthorized transactions and loss of funds. The command does not inherently obtain root access, but users who invoke it from an elevated shell would expose the corresponding elevated scope. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Delete the pipe-to-shell command from the README. 2. Make the versioned package-manager method the primary installation route. 3. Pin source-based instructions to a tagged release or immutable commit rather than `main`. 4. If installation scripts are retained, require separate download, cryptographic integrity verification, review, and execution steps. 5. Publish signed release artifacts and document how users can verify the signing identity. 6. Warn users not to execute installers with elevated privileges unless a narrowly defined installation step demonstrably requires them. Example hardened workflow: ```bash curl -fL -o install.sh "https://raw.githubusercontent.com/Polymarket/polymarket-cli/<IMMUTABLE_COMMIT>/install.sh" echo "<TRUSTED_SHA256> install.sh" | sha256sum -c - less install.sh sh install.sh ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:55
• Finding: Wallet Private Key May Be Supplied Through Exposed Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:55-58` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium **Vulnerable Code**: ```text Private key is resolved in order: 1. CLI flag: `--private-key 0xabc...` 2. Environment variable: `POLYMARKET_PRIVATE_KEY=0xabc...` 3. Config file: `~/.config/polymarket/config.json` ``` ### Technical Analysis The documented first-priority mechanism permits a cryptocurrency wallet private key to be passed as a command-line argument. Command-line secrets may be exposed through shell history, process inspection, command auditing, terminal recording, diagnostic output, automation logs, or Agent transcripts. The alternative environment-variable mechanism can also leak through child-process inheritance, debugging tools, crash reports, or improperly protected runtime environments. A plaintext configuration file is sensitive unless strict ownership and permissions are enforced. The documentation does not state permission requirements, redaction guarantees, or secure secret-storage controls. ### Attack Path 1. A user configures or invokes the CLI using the documented `--private-key` argument. 2. The command is retained in shell history, captured by logging, or temporarily visible through local process inspection. 3. Another local user, process, administrator, log reader, or compromised tool obtains the argument. 4. The attacker imports the disclosed private key into a wallet under their control. 5. The attacker signs unauthorized transactions or transfers assets from the victim's wallet. For the environment-variable or configuration-file alternatives, exploitation similarly requires access to the process environment, inherited child process, backup, log, or insufficiently protected configuration file. ### Impact Assessment Disclosure of a wallet private key grants the ability to authenticate as the wallet owner and sign transactions. Depending on wallet balances, approvals, and con ...[truncated 364 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove private-key command-line arguments from recommended usage. 2. Prefer a hardware wallet, OS credential manager, encrypted keystore, or an interactive no-echo secret prompt. 3. If a secret file is unavoidable: - Store it outside the project directory. - Require owner-only permissions, such as mode `0600`. - Avoid including it in backups, logs, source control, or Agent context. - Encrypt it at rest using an appropriate key-management mechanism. 4. Treat environment variables as a compatibility fallback rather than the preferred method, and warn about inheritance and diagnostic exposure. 5. Ensure the CLI redacts private keys and API credentials from errors, debug output, telemetry, and command summaries. 6. Instruct users to rotate the wallet immediately if a private key has appeared in command history, logs, screenshots, or transcripts. 7. Encourage dedicated low-balance trading wallets with narrowly scoped approvals to limit the impact of credential compromise. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Chaining Abuse

High

• Category: Tool Misuse

Content

**Shell script:**
```bash
curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh
```

**Build from source:**

• Confidence: 99% confidence
• Finding: The pipe into 'sh' is the dangerous execution step because it turns untrusted remote content directly into shell commands. In a trading skill context, this is especially sensitive because users may run it on machines holding wallets, API tokens, or financial credentials, increasing the blast radius of any compromise.

Chaining Abuse

High

• Category: Tool Misuse

Content

### Shell script
```bash
curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh
```

### Build from source (Rust)

• Confidence: 98% confidence
• Finding: The `| sh` pipeline is especially dangerous because it chains untrusted network content directly into a shell interpreter, eliminating any inspection barrier and making malicious modifications instantly executable. In a trading skill that may later manage wallets, approvals, and API keys, compromise of the host could lead to theft of private keys, unauthorized trades, or broader system compromise.

Session Persistence

Medium

• Category: Rogue Agent

Content

polymarket setup

# Or manually:
polymarket wallet create
polymarket approve set  # needs MATIC for gas on Polygon
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Scope Creep

Low

• Category: Excessive Agency

Content

- Speed: Place and cancel orders faster than the web UI
- Automation: Script market-making and hedging strategies
- Transparency: See exactly what commands run before execution
- Control: Manage everything from your terminal
- Data: JSON output for programmatic analysis

**What makes this different:**

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

External Script Fetching

Low

• Category: Supply Chain

Content

**Shell script:**
```bash
curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh
```

**Build from source:**

• Confidence: 98% confidence
• Finding: The README instructs users to fetch and immediately execute a remote install script via curl, which creates a supply-chain and remote code execution risk. If the upstream repository, network path, or referenced script is compromised, users may run arbitrary shell commands on their system without reviewing them first.

External Script Fetching

Low

• Category: Supply Chain

Content

### Shell script
```bash
curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh
```

### Build from source (Rust)

• Confidence: 96% confidence
• Finding: The skill instructs users to fetch and execute a remote install script directly with `curl ... | sh`, which grants immediate code execution to whatever content is served at that URL at execution time. If the upstream repository, network path, or hosting account is compromised, users could run arbitrary attacker-controlled code on their machine without review.

Static analysis

No suspicious patterns detected.