Security audit

Polymarket News Events

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed automated trading skill, but its live-trading path has enough safety and scoping gaps that users should review it carefully before installing.

Install only after reviewing and constraining live trading. Use dry-run first, pin dependencies, remove or replace plaintext HTTP feeds, require a second live-trading confirmation, scope SIMMER_API_KEY to minimal funds and permissions, and store state in a private per-user directory.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: news_events.py:40
Finding: Trading Safety Checks Fail Open When Market Context Is Unavailable
Content: View full analysis
0.15: return False, "slippage too high" edge = ctx.get("edge_analysis", {}) if edge.get("recommendation") == "HOLD": return False, "edge below threshold" return True, "ok" except Exception: return True, "context unavailable" ``` The returned approval is used as follows: ```python ok, reason = check_context(client, market_id) if not ok: log.warning("Skipping trade: %s", reason) continue ``` ### Technical Analysis `check_context()` is intended to enforce pre-trade safeguards covering severe flip-flop warnings, excessive slippage, and insufficient market edge. However, every exception—including network timeouts, authentication errors, SDK failures, malformed responses, and unexpected response types—is converted into an affirmative trading decision. This is a fail-open security design. The absence of validated safety information is treated as equivalent to successful validation. In live mode, execution can consequently continue to `client.trade(...)` while all contextual risk controls are unavailable. The broad `except Exception` also suppresses the underlying error and ...[truncated 1111 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: news_events.py:99
Finding: Plaintext HTTP RSS Input Can Influence Automated Live Trades
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: news_events.py:66
Finding: Predictable Shared Temporary State File Is Vulnerable to Symlink and State Manipulation Attacks
Content: View full analysis
set: try: with open(STATE_FILE, "r") as f: data = json.load(f) # Prune entries older than 24h cutoff = (datetime.now(timezone.utc) - timedelta(hours=24)).isoformat() return {k for k, v in data.items() if v > cutoff} except (FileNotFoundError, json.JSONDecodeError): return set() def save_seen(seen: set): now = datetime.now(timezone.utc).isoformat() data = {h: now for h in seen} try: with open(STATE_FILE, "w") as f: json.dump(data, f) except Exception: pass ``` ### Technical Analysis The Skill stores transaction-deduplication state at a fixed, publicly predictable path in the shared `/tmp` directory. It opens this path using ordinary file operations without: - checking ownership or file type; - preventing symbolic-link traversal; - securely creating the file; - enforcing restrictive permissions; - using atomic replacement; - locking against concurrent executions. A local user can pre-create or replace the path. Because `open(..., "w")` follows symbolic links and truncates the destination, the Skill can be induced to overwrite another file writable by its process identity. A local attacker can also replace or corrupt the JSON state to alter which stories are considered previously processed. The broad exception suppression in `save_seen()` hides failed or manipulated state writes, making detection difficult. ### Attack Path **State manipulation path:** 1. A local attacker writes chosen JSON data to `/tmp/polymarket_news_seen.json`. 2. The Skill loads the attacker-controlled hashes and timestamps. 3. Legitimate stories ...[truncated 1063 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: clawhub.json:4
Finding: Security-Critical Python Dependencies Are Unpinned and Lack Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises capabilities that imply access to environment variables, local file operations, and network resources, but it does not declare any explicit tool scope or permission boundaries in the manifest. For an automated trading skill that consumes external feeds and can be switched to live execution, this omission increases the risk of over-privileged execution, unintended data exposure such as SIMMER_API_KEY access, and unsafe network or file behavior without clear operator review.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · news_events.py (reported line 87)May include surrounding context.
python
"cnbc_top": {"url": "https://search.cnbc.com/rs/search/combinedcms/view.xml?partnerId=wrss01&id=100003114", "tier": 2}, "marketwatch": {"url": "https://feeds.marketwatch.com/marketwatch/topstories/", "tier": 2}, "politico": {"url": "https://www.politico.com/rss/politicopicks.xml", "tier": 2}, "axios": {"url": "https://api.axios.com/feed/", "tier": 2}, "thehill": {"url": "https://thehill.com/feed/", "tier": 2}, "ft": {"url": "https://www.ft.com/rss/home", "tier": 2},

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill can place live trades when invoked with --live, but it does not present a clear, explicit runtime confirmation or prominent user-facing warning immediately before execution. In a trading skill, this increases the risk of accidental real-money orders from operator error, automation misuse, or misunderstanding of the mode, especially because the same code path supports both dry-run and live execution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.