Polymarket Weather Scanner

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:23 PM UTC
• Version: 1.1.0

Overview

The skill is mostly coherent for a Polymarket weather scanner, but it can forward its API key to an arbitrary host override despite saying the key goes only to the scanner API.

Install only if you trust the Polymarket Weather Scanner service and your agent's execution environment. Avoid setting POLYMARKET_SCANNER_HOST unless you control the endpoint, and treat POLYMARKET_SCANNER_API_KEY as a credential that could be exposed by a bad host override. Prefer explicit /scan and /forecast invocations rather than letting vague weather or trading questions trigger the skill automatically.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scan.sh:7

Finding

API Key Disclosure Through an Unrestricted Service Host Override

Content

View full analysis

Vulnerability Details

File Location: scripts/cities.sh:6-11, scripts/forecast.sh:7-22, and scripts/scan.sh:7-13
Vulnerability Type: User-controlled request destination combined with credential forwarding
Risk Level: Medium

Vulnerable Code

scripts/cities.sh:6-11

bash

HOST="${POLYMARKET_SCANNER_HOST:-https://polymarket-scanner.fly.dev}"
API_KEY="${POLYMARKET_SCANNER_API_KEY:-}"

RESPONSE=$(curl -s -w "\n%{http_code}" \
    ${API_KEY:+-H "X-API-Key: ${API_KEY}"} \
    "${HOST}/cities")

scripts/forecast.sh:7-22

bash

HOST="${POLYMARKET_SCANNER_HOST:-https://polymarket-scanner.fly.dev}"
API_KEY="${POLYMARKET_SCANNER_API_KEY:-}"

CITY="${1:?Usage: forecast.sh <city> [YYYY-MM-DD]}"
# Sanitize city input: only allow alphanumeric, spaces, hyphens
CITY=$(echo "$CITY" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9 -]//g' | sed 's/ /%20/g')
DATE="${2:-}"

URL="${HOST}/forecast/${CITY}"
if [ -n "$DATE" ]; then
    URL="${URL}?target_date=${DATE}"
fi

RESPONSE=$(curl -s -w "\n%{http_code}" \
    ${API_KEY:+-H "X-API-Key: ${API_KEY}"} \
    "$URL")

scripts/scan.sh:7-13

bash

HOST="${POLYMARKET_SCANNER_HOST:-https://polymarket-scanner.fly.dev}"
API_KEY="${POLYMARKET_SCANNER_API_KEY:-}"
DAYS="${1:-1}"

RESPONSE=$(curl -s -w "\n%{http_code}" \
    ${API_KEY:+-H "X-API-Key: ${API_KEY}"} \
    "${HOST}/scan/weather?days_ahead=${DAYS}")

Technical Analysis

The three scripts allow the POLYMARKET_SCANNER_HOST environment variable to replace the trusted API origin without validating its scheme, hostname, or port. They then attach the value of POLYMARKET_SCANNER_API_KEY as an X-API-Key header to requests sent to that destination.

This creates a credential-forwarding vulnerability across a mutable trust boundary. An attacker who can influence the environment in which the skill runs can redirect requests from the intended `https://polymarket- ...[truncated 1874 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the production host override and use a fixed trusted origin:

   bash

   readonly HOST="https://polymarket-scanner.fly.dev"
   

2. If an override is required for development, enforce an explicit allowlist before attaching credentials:

   bash

   HOST="${POLYMARKET_SCANNER_HOST:-https://polymarket-scanner.fly.dev}"
   
   case "$HOST" in
     "https://polymarket-scanner.fly.dev")
       ;;
     *)
       echo "Error: untrusted scanner host" >&2
       exit 1
       ;;
   esac
   

3. Never forward production credentials to arbitrary development hosts. If non-production endpoints must be supported, require a separate development credential and suppress the production API-key header.

4. Build curl arguments with a Bash array so every option and value remains a single, well-defined argument:

   bash

   curl_args=(
     --silent
     --show-error
     --fail-with-body
     --write-out $'\n%{http_code}'
   )
   
   if [[ -n "$API_KEY" ]]; then
     curl_args+=(-H "X-API-Key: $API_KEY")
   fi
   
   RESPONSE=$(curl "${curl_args[@]}" "${HOST}/scan/weather?days_ahead=${DAYS}")
   

5. Require HTTPS and validate the normalized hostname rather than relying on a prefix or substring check. Reject URLs containing embedded credentials, unexpected ports, redirects to untrusted hosts, or unsupported schemes.

6. Consider disabling redirects or restricting them because curl may otherwise reach an unintended destination. Use an explicit redirect policy and ensure sensitive headers are never forwarded across origins.

7. Rotate any API key that may previously have been used while POLYMARKET_SCANNER_HOST pointed to an untrusted endpoint.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This second description-behavior mismatch similarly indicates the skill may only fetch subscription or status data from a remote endpoint while claiming sophisticated forecast and trading analysis. Such deception or poor disclosure can cause users to expose metadata or API credentials to a third party and rely on output that is not independently verifiable.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This second description-behavior mismatch similarly indicates the skill may only fetch subscription or status data from a remote endpoint while claiming sophisticated forecast and trading analysis. Such deception or poor disclosure can cause users to expose metadata or API credentials to a third party and rely on output that is not independently verifiable.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to execute shell scripts but does not declare an explicit tool scope such as allowed-tools or permissions. This weakens least-privilege controls and can let a host system or agent runtime expose broader shell capability than users expect, increasing the blast radius if the scripts are modified or abused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The /scan command is bound to broad natural-language triggers such as generic requests to find opportunities or check for edge, which can cause unintended activation. In an agent setting, loose triggers can prompt unsolicited shell execution and network access to external services from ambiguous user requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The /forecast activation text is also overly broad, allowing ordinary weather questions or model-comparison requests to trigger shell execution and remote API calls. Because the skill contacts an external service and may transmit identifiers like API keys, accidental invocation is more dangerous than in a purely local read-only skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This shell script makes a network call to a remote host using curl and may include an API key header, but there is no visible confirmation prompt, user-facing notice, or explanatory comment near the transmission. For code files, outbound network operations that transmit user or system data can warrant a finding when they lack any user disclosure and are not explicitly framed to the user at execution time.

Content

No source excerpt is available for this finding.