ClawHub
Back to skill

Security audit

Polyvision

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a Polymarket analytics skill, but it should be reviewed because it can also change saved portfolio entries and API-key state despite being framed mainly as read-only analysis.

Install only if you trust PolyVision with your API key, wallet queries, and account metadata. Treat portfolio add/remove and API-key regenerate/deactivate as account-changing actions that should be invoked only after clear user confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- Placing trades or executing orders — PolyVision never trades on-chain, executes orders, or moves funds
- Non-Polymarket wallet lookups (Ethereum DeFi, NFTs, etc.)

> **What PolyVision can and cannot change:** Every analysis, scoring, leaderboard, hot-bets, strategy, trades, and discovery tool is **read-only** — PolyVision never places trades, executes orders, or touches the blockchain or your funds. The *only* state it can modify is **your own** PolyVision tracked-wallet portfolio (a saved watch-list scoped to your API key), via the `add_to_portfolio` and `remove_from_portfolio` tools and their REST equivalents (`POST` / `DELETE /v1/portfolio`). Those two tools are flagged below with a ⚠️ mutation warning; treat them as state-changing and only call them when the user explicitly asks.

## Setup: MCP Server (Recommended)
Confidence
93% confidence
Finding
The skill includes state-changing portfolio mutation capabilities, which creates a real risk of unauthorized or prompt-induced account changes if an agent invokes them without strict user confirmation. Although the file explicitly warns that these tools should only be used on explicit request, natural-language instructions alone are not a sufficient technical safeguard against misuse or prompt injection.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| `GET /v1/discover` | GET | Discover a random elite trader |
| `GET /v1/portfolio?page=0&limit=10` | GET | Get your tracked wallet portfolio |
| `POST /v1/portfolio` | POST | Add a wallet to your portfolio (JSON body: `wallet_address`, `nickname`) |
| `DELETE /v1/portfolio/{wallet_address}` | DELETE | ⚠️ Remove a wallet from your portfolio |
| `GET /health` | GET | Health check (no auth required) |

### Example: Analyze a wallet
Confidence
94% confidence
Finding
The REST delete endpoint enables permanent removal of tracked wallets, so an agent that can compose requests could make unintended destructive changes if influenced by ambiguous prompts or adversarial content. The surrounding documentation marks it as mutating, which helps, but the existence of a destructive endpoint accessible with the same bearer credential still presents meaningful tool-abuse risk.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
}
```

### REST API Response (`DELETE /v1/portfolio/{wallet_address}`)

Success returns same shape as MCP. Errors return HTTP status codes: `404` (not found), `400` (invalid address).
Confidence
80% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Transmission

Medium
Category
Data Exfiltration
Content
"mcpServers": {
    "polyvision": {
      "type": "streamable-http",
      "url": "https://api.polyvisionx.com/mcp",
      "headers": {
        "Authorization": "Bearer ${POLYVISION_API_KEY}"
      }
Confidence
91% confidence
Finding
The skill instructs the agent to send authenticated requests to an external MCP endpoint using a bearer API key. Any use of this skill transmits user queries and wallet identifiers to a third-party service, and the credential is exposed to that service by design, creating data-sharing and secret-handling risk if the service is compromised or over-collects data.

External Transmission

Medium
Category
Data Exfiltration
Content
For agents that cannot use MCP, the data and account tools are available as REST endpoints at `https://api.polyvisionx.com`. (`calculate` and `get_knowledge` are MCP-only — there is no REST equivalent.) All endpoints require Bearer token authentication except `GET /health`. Analysis and market-data endpoints additionally require Premium or an active trial (see **Access & Tiers**) and return **403** without it.

Interactive docs and the OpenAPI spec are available at:
- **Swagger UI:** `https://api.polyvisionx.com/docs`
- **OpenAPI JSON:** `https://api.polyvisionx.com/openapi.json`

| Endpoint | Method | Description |
Confidence
90% confidence
Finding
The REST interface explicitly directs agents to transmit data and bearer credentials to an external domain. This creates the same outbound data exposure and credential-delegation risk as the MCP path, especially because multiple account and analysis endpoints are available and could be invoked programmatically.

External Transmission

Medium
Category
Data Exfiltration
Content
Interactive docs and the OpenAPI spec are available at:
- **Swagger UI:** `https://api.polyvisionx.com/docs`
- **OpenAPI JSON:** `https://api.polyvisionx.com/openapi.json`

| Endpoint | Method | Description |
|----------|--------|-------------|
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Interactive docs and the OpenAPI spec are available at:
- **Swagger UI:** `https://api.polyvisionx.com/docs`
- **OpenAPI JSON:** `https://api.polyvisionx.com/openapi.json`

| Endpoint | Method | Description |
|----------|--------|-------------|
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Interactive docs and the OpenAPI spec are available at:
- **Swagger UI:** `https://api.polyvisionx.com/docs`
- **OpenAPI JSON:** `https://api.polyvisionx.com/openapi.json`

| Endpoint | Method | Description |
|----------|--------|-------------|
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Interactive docs and the OpenAPI spec are available at:
- **Swagger UI:** `https://api.polyvisionx.com/docs`
- **OpenAPI JSON:** `https://api.polyvisionx.com/openapi.json`

| Endpoint | Method | Description |
|----------|--------|-------------|
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Interactive docs and the OpenAPI spec are available at:
- **Swagger UI:** `https://api.polyvisionx.com/docs`
- **OpenAPI JSON:** `https://api.polyvisionx.com/openapi.json`

| Endpoint | Method | Description |
|----------|--------|-------------|
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Interactive docs and the OpenAPI spec are available at:
- **Swagger UI:** `https://api.polyvisionx.com/docs`
- **OpenAPI JSON:** `https://api.polyvisionx.com/openapi.json`

| Endpoint | Method | Description |
|----------|--------|-------------|
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Interactive docs and the OpenAPI spec are available at:
- **Swagger UI:** `https://api.polyvisionx.com/docs`
- **OpenAPI JSON:** `https://api.polyvisionx.com/openapi.json`

| Endpoint | Method | Description |
|----------|--------|-------------|
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The manifest describes read-oriented wallet analysis, leaderboard screening, hot bets, trade history, and wallet discovery, but this schema file also documents portfolio tracking endpoints (`get_portfolio`, `add_to_portfolio`, `remove_from_portfolio`) and an auth/account inspection endpoint (`GET /v1/auth/me`). Those capabilities materially extend the skill from analytics into persistent watchlist management and API-account metadata access, which are not disclosed in the manifest description.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The documented auth response includes account-identifying and usage fields such as email, API key prefix, usage counts, and key activity timestamps without any privacy warning or minimization guidance. In an agent setting, this increases the chance that sensitive account metadata is surfaced, logged, or echoed to users without informed consent, enabling profiling or operational intelligence leakage.

Vague Triggers

Low
Confidence
77% confidence
Finding
The 'When to Use' section says to invoke the skill when a user asks for copy trading strategy recommendations or optimal settings, which is a broad financial-advice-style request that could overlap with general trading discussions beyond this tool's intended scope. Although the document is mostly Polymarket-specific, these trigger bullets do not themselves restate the Polymarket limitation or give exclusion examples, which can increase accidental invocation risk.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:63