Polymarket Preflight (TickTape)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:13 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed read-only Polymarket risk-checking integration, with a supply-chain caution for its optional unpinned npm SDK.

Before installing or using the SDK, prefer direct HTTPS calls where possible, or pin the npm package version and keep payment tokens out of the install environment. Use the free sandbox first, enforce the documented spend caps, and treat TickTape bearer tokens like private keys.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:90

Finding

Unpinned Third-Party npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 90
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

markdown

JS SDK (zero-dep, handles 402 parsing): `npm install ticktape`.

Technical Analysis

The documented installation command does not specify an exact package version, lockfile, integrity hash, or reviewed source revision. Consequently, npm install ticktape resolves whichever package release the npm registry currently designates, rather than the version that existed when this Skill was audited.

If the package, its publishing account, or the registry distribution channel is compromised, a malicious future release could execute lifecycle scripts during installation or run attacker-controlled code when imported. This risk is especially relevant because the SDK is intended to process x402 payment authorizations and prepaid bearer tokens.

The SDK is not essential to the declared read-only risk-checking functionality because SKILL.md also documents direct HTTPS API calls. Installing mutable third-party code therefore introduces avoidable supply-chain privileges beyond the minimum needed to call the service.

Attack Path

1. An attacker compromises the ticktape npm package, its maintainer account, or its distribution process.
2. The attacker publishes a malicious release and causes it to be resolved by the unversioned installation command.
3. An operator or Agent follows the Skill documentation and runs npm install ticktape.
4. Malicious code executes through an npm lifecycle script or when the installed SDK is imported.
5. The code accesses resources available to the installing process, potentially including environment variables, payment authorization material, prepaid TickTape bearer tokens, local files, and network access.
6. Stolen information may then be transmitted to attacker-controlled infrastructure or used to perform unau ...[truncated 997 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned command with an exact, reviewed package version, such as npm install --save-exact ticktape@<audited-version>.
2. Supply and verify a lockfile containing npm integrity metadata.
3. Link the documented package version to a reviewed source repository commit and verify that the published artifact corresponds to that revision.
4. Use npm install --ignore-scripts where lifecycle scripts are unnecessary, and document any functionality affected by disabling them.
5. Prefer direct HTTPS requests to the documented API endpoints when SDK functionality is not required.
6. Run dependency installation and SDK execution in a restricted environment with minimal filesystem access and only the necessary environment variables.
7. Keep prepaid tokens and payment authorization data out of the installation environment. Inject them only at runtime through a narrowly scoped secret mechanism.
8. Add automated dependency scanning and package provenance or signature verification to detect compromised or unexpectedly changed releases.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep