Polymarket Fast Loop Improved

• Outcome: Review
• Latest audit: May 28, 2026 at 8:30 AM UTC
• Version:
  0.1.0

Overview

This trading skill is plausible, but it should be reviewed because it declares a live-trading script that is not included and provides unattended real-money cron commands.

Install only if you already have and trust the exact fastloop_improved.py implementation that will be run. Keep it in paper mode first, verify daily budget and position limits, avoid unattended live cron until you have monitoring and a stop plan, and use a low-balance or limited-scope API key where possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill includes turnkey cron commands that run `python fastloop_improved.py --live --quiet` every 5 minutes, which materially lowers the barrier to continuous real-money trading. Although the document mentions paper mode by default and warns elsewhere about validating first, the invocation points themselves do not restate that these loop commands trigger unattended live execution with real financial consequences, increasing the risk of accidental deployment.

VirusTotal

64/64 vendors flagged this skill as clean.