DRADIS PolyMarket & Kalshi Trading Automation

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:18 AM UTC
• Version: 1.5.1

Overview

This is a disclosed DRADIS trading monitor and configuration skill with real-money risk, but its access is purpose-aligned and it does not hide destructive behavior.

Install only for a DRADIS instance you control. Use a dedicated least-privilege DRADIS_API_KEY, prefer read-only mode where appropriate, and review every proposed config or LLM-action approval because accepted changes can affect live trading behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

These are intentional and documented. The skill **never** applies config changes without explicit human confirmation.

This skill is **monitoring and configuration only, by design.** It deliberately exposes no tool that opens, closes, or settles a position, and none that deploys a squadron. The engine's API does offer such endpoints (`DELETE /api/positions/{token_id}`, `POST /api/positions/manual-exit`, `POST /api/positions/sync`, `POST /api/squadrons/deploy`) — they are omitted here so that no agent turn can spend money or flatten a position. Perform those actions in the Control Tower UI.

I strongly recommend using a dedicated, least-privilege API key and only running this skill against your own trusted DRADIS instance.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.

md

| Endpoint | Why omitted |
|---|---|
| `DELETE /api/positions/{token_id}` | Removes a tracked position |
| `POST /api/positions/manual-exit` | Places a real exit order (`intl` builds only) |
| `POST /api/positions/sync` | Mutates position records from chain state (`intl` builds only) |
| `POST /api/squadrons/deploy` | Commits capital to a new market |

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file includes natural-language command examples such as "What's the current status of DRADIS?" and "Show me open positions and session P&L" without defining stricter trigger scope, exclusions, or where these phrases apply. While somewhat domain-specific, the file does not clearly state activation boundaries or negative examples, which can make invocation matching overly broad for a user-invocable skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.