Security audit

Polymarket News Events

Security checks for vulnerabilities and agentic risk

Overview

This skill is not deceptive, but it can place repeated real-money trades from external news feeds with weak safeguards, so it needs careful review before use.

Install only if you are comfortable with automated trading risk. Keep dry-run mode until you have reviewed the feeds, pinned dependencies, removed plaintext RSS, changed safety checks to fail closed, added explicit live-trading confirmation or arming, and used a least-privilege trading key with strict per-trade and daily limits.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: news_events.py:102
Finding: Plaintext RSS feed can influence automated financial trades
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: news_events.py:32
Finding: Market safety validation fails open when context retrieval fails
Content: View full analysis
0.15: return False, "slippage too high" edge = ctx.get("edge_analysis", {}) if edge.get("recommendation") == "HOLD": return False, "edge below threshold" return True, "ok" except Exception: return True, "context unavailable" ``` ```python ok, reason = check_context(client, market_id) if not ok: log.warning("Skipping trade: %s", reason) continue if live: try: result = client.trade( market_id=market_id, side=side, amount=TRADE_SIZE_USD, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning, ) ``` ### Technical Analysis `check_context()` is intended to prevent trades when flip-flop behavior, excessive slippage, or insufficient edge is detected. Any exception raised while retrieving or parsing the market context is instead converted into an approval result: ```python return True, "context unavailable" ``` Consequently, network failures, service errors, malformed SDK responses, schema changes, and unexpected value types bypass all three safeguards. A security or risk control should fai ...[truncated 1460 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: clawhub.json:4
Finding: Security-sensitive dependencies are not version-pinned
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: news_events.py:58
Finding: Predictable shared temporary state file permits local tampering and symlink attacks
Content: View full analysis
set: try: with open(STATE_FILE, "r") as f: data = json.load(f) # Prune entries older than 24h cutoff = (datetime.now(timezone.utc) - timedelta(hours=24)).isoformat() return {k for k, v in data.items() if v > cutoff} except (FileNotFoundError, json.JSONDecodeError): return set() def save_seen(seen: set): now = datetime.now(timezone.utc).isoformat() data = {h: now for h in seen} try: with open(STATE_FILE, "w") as f: json.dump(data, f) except Exception: pass ``` ### Technical Analysis The Skill uses a fixed, predictable filename in the globally shared `/tmp` directory. It opens the path using ordinary `open()` calls without checking file ownership, rejecting symbolic links, applying an explicit restrictive mode, or using an atomic replacement strategy. On systems where multiple users or processes can write to `/tmp`, a local attacker can pre-create the path, replace it, or make it a symbolic link. The read path trusts attacker-controlled JSON as the set of previously processed story hashes. The write path follows symbolic links and truncates the target before writing JSON. Suppressing all save errors further conceals state-integrity failures and may cause repeated processing after the state cannot be persisted. ### Attack Path **State manipulation path:** 1. A local attacker creates `/tmp/polymarket_news_seen.json` before the Skill starts. 2. The attacker writes valid JSON containing selected story hashes and future or recent timestamps. 3. `load_seen()` accepts the data without checking ownership or provenance. ...[truncated 936 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares capabilities that imply access to environment variables, filesystem, and network, but it does not explicitly constrain or document tool permissions in the manifest. For an automated trading skill that consumes external feeds and can operate in live mode, this missing scope increases the chance of over-privileged execution, secret exposure, unintended file access, or abuse of network access if the implementation is compromised or behaves unexpectedly.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · news_events.py (reported line 87)May include surrounding context.
python
"cnbc_top": {"url": "https://search.cnbc.com/rs/search/combinedcms/view.xml?partnerId=wrss01&id=100003114", "tier": 2}, "marketwatch": {"url": "https://feeds.marketwatch.com/marketwatch/topstories/", "tier": 2}, "politico": {"url": "https://www.politico.com/rss/politicopicks.xml", "tier": 2}, "axios": {"url": "https://api.axios.com/feed/", "tier": 2}, "thehill": {"url": "https://thehill.com/feed/", "tier": 2}, "ft": {"url": "https://www.ft.com/rss/home", "tier": 2},

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill can place live trades immediately when invoked with --live, but it does not present an explicit confirmation or last-moment warning at the point of order submission. In an automated trading skill that acts on noisy third-party RSS input, this increases the chance of accidental real-money execution due to operator error, misconfiguration, or unattended runs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.