Polymarket Candle Momentum

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:32 AM UTC
• Version: 2.0.0

Overview

This is a disclosed trading bot, but live mode can place real-money trades automatically and one pre-trade safety check fails open.

Install only if you are comfortable with an automated trading script using your Simmer API key. Keep dry-run until you have reviewed the strategy, use a tightly limited API key and small position limits, avoid unattended live cron until the fail-open safety check is fixed, and pin/review dependencies before live use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: candle_momentum.py:78

Finding

Live Trading Safety Validation Fails Open

Content

View full analysis

0.15: return False, "slippage too high" edge = ctx.get("edge_analysis", {}) if edge.get("recommendation") == "HOLD": return False, "edge below threshold" return True, "ok" except Exception: return True, "context unavailable" ``` The returned approval is consumed immediately before live trading: ```python ok, reason = check_context(client, market_id) if not ok: if not quiet: print(f" Skipping trade: {reason}") return {"action": "skip", "reason": reason} try: result = client.trade( market_id=market_id, side=side, amount=amount, venue=os.environ.get("TRADING_VENUE", "polymarket"), source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=full_reasoning, ) ``` ### Technical Analysis `check_context()` is a security and financial-risk gate intended to reject trades when there is severe flip-flopping, excessive slippage, or inadequate trading edge. Its broad exception handler converts every context-validation failure into approval by returning `True`. Failures covered by this behavior include network timeouts, authe ...[truncated 1867 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:3

Finding

Executable Third-Party Dependencies Are Not Version-Pinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tainted flow: 'api_key' from os.environ.get (line 231, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · candle_momentum.py (reported line 232)May include surrounding context.

python

"""Find active fast markets for the configured asset via Simmer REST API."""
    try:
        api_key = os.environ.get("SIMMER_API_KEY", "")
        resp = requests.get(
            f"{SIMMER_API_BASE}/api/sdk/fast-markets",
            headers={"Authorization": f"Bearer {api_key}"},
            params={

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation describes capabilities that access environment variables and make network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent setting, missing capability declarations weaken least-privilege controls and make it harder for operators to understand or constrain what the skill may access at runtime.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The security notes state that only SIMMER_API_KEY is read from the environment, but the rest of the document specifies multiple CM_* environment variables for trading behavior. This is misleading security documentation: operators may underestimate what external inputs can influence the strategy, including position sizing and entry criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The repeated assertion that only SIMMER_API_KEY is read from the environment contradicts the documented CM_* configuration variables. Repeated contradictory statements can cause unsafe deployment assumptions, especially for automated trading skills where environment-controlled thresholds materially affect execution behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

- Only `SIMMER_API_KEY` is read from environment. Nothing else.
- No host files are read. No logs written outside the script's own stdout.
- `automaton.managed` is `false` - the skill does not auto-execute.
- Dry-run by default. `--live` must be passed explicitly.

## Trade Execution Path

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file claims configuration is handled via environment variables only, yet the CLI advertises a mutable --set KEY=VALUE interface. This discrepancy can hide local state changes or persistence behavior from reviewers and operators, undermining trust in the documented security model and increasing the chance of unexpected configuration tampering.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · candle_momentum.py (reported line 33)May include surrounding context.

python

TRADE_SOURCE = "sdk:polymarket-candle-momentum"
SKILL_SLUG = "polymarket-candle-momentum"

BINANCE_KLINES_URL = "https://api.binance.com/api/v3/klines"

ASSET_SYMBOLS = {
    "BTC": "BTCUSDT",

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest narrowly describes a scanner over five named assets, but the implementation includes DOGE, ADA, and AVAX in ASSET_SYMBOLS and allows overriding asset via config and environment variables. This expands the actual trading universe beyond the declared behavior, which is a semantic mismatch with the skill description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When run with --live, the skill places real trades immediately based on external market data and configuration without a final interactive confirmation or stronger execution guardrail. In a trading skill, that increases the chance of accidental financial loss from operator error, misconfiguration, bad signals, or unexpected runtime conditions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The inline documentation for select_best_market states it chooses the best market based on time remaining and live status, while the overall skill description says the strategy picks the strongest signal each cycle. In practice, the code first chooses one market per asset by time remaining before comparing cross-asset signal strength, so the documentation presents a materially different basis for selection than the stated strategy intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.