T06 · System Persistence
Error
- Location
skills/polymarket-btc-up-down-trader/SKILL.md:60- Finding
Persistent Unattended Real-Money Trading Through Scheduled Tasks
- Content
View full analysis
- Remediation
View remediation
Security audit
Weather Max Bot
Security checks for vulnerabilities and agentic risk
Overview
This package mixes inconsistent identities and includes a real-money automated Polymarket trading strategy with credential and cron instructions that need careful review.
Review this carefully before installing. Treat it as a package that includes an automated real-money BTC Polymarket trader, not only the root Simmer orientation. Use dry-run first, avoid live quiet cron unless you have strict external limits and monitoring, prefer managed or dedicated low-balance wallets, and pin/review the SDK version before exposing credentials.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Error
- Location
skills/polymarket-btc-up-down-trader/SKILL.md:30- Finding
Unpinned Trading SDK Executes With API and Wallet Credentials
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/polymarket-btc-up-down-trader/strategy.py:782- Finding
Trade Responses Are Recorded as Successful Without Status Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents a full-featured prediction market trading interface spanning Polymarket and Kalshi, including wallet and safety/context features. The supplied code is much narrower: it reads an API key from the environment, fetches market listings from a single endpoint, and logs a few entries. This is a materially different primary purpose from the declared one, so the description does not accurately represent the code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description claims a broad prediction-market interface covering both Polymarket and Kalshi through one API. The supplied code instead implements a narrowly scoped BTC up/down Polymarket trader. Its primary purpose is automated strategy execution: discover eligible BTC markets, compute Binance-based momentum signals, enter trades when thresholds are met, and exit positions based on time-to-resolution, target-profit capture, or volume spikes. It does not expose a general unified interface, does not interact with Kalshi, and is materially more specific than the declared purpose. Therefore the description does not accurately represent the code's actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description claims a broad interface for AI agents to trade across Polymarket and Kalshi through one API with self-custody wallets and safety rails. The supplied code chunk instead consists entirely of unit tests for one concrete skill: a Polymarket BTC up/down trader. It validates specific strategy behaviors such as time-capped exits, target-profit exits, volume-spike exits, trigger priority, and entry-edge calculations. While this is related to prediction-market trading, it does not match the declared primary purpose of a cross-platform agent interface. There is no evidence here of a unified API, Kalshi integration, wallet functionality, or general-purpose trading interface behavior. Therefore the code chunk materially differs from the declared description.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The metadata slug identifies the skill as a 'weather-max-trader-bot', which does not match the declared skill context of 'simmer', a Polymarket/Kalshi prediction market interface. This kind of identity mismatch is dangerous because it can mislead users, evade review workflows, or cause the wrong automation to be installed or trusted under a misleading label.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents use of environment variables and outbound network access, but it does not declare any tool scope or permissions boundary. In an agent ecosystem, missing explicit scope increases the chance that a host grants broader capabilities than necessary, making accidental secret access or unintended network actions more likely.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
1. Register your agent
bash curl -X POST https://api.simmer.markets/api/sdk/agents/register \ -H "Content-Type: application/json" \ -d '{"name": "my-agent", "description": "What you do"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
1. Register your agent
bash curl -X POST https://api.simmer.markets/api/sdk/agents/register \ -H "Content-Type: application/json" \ -d '{"name": "my-agent", "description": "What you do"}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code reads a sensitive API credential from an environment variable and immediately uses it in an outbound HTTPS Authorization header. There is no comment, docstring, or user-facing disclosure indicating that credentials will be accessed and sent to a remote service.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The package metadata materially conflicts with the declared skill identity: the file names the package 'weather-max-bot' and describes it as a 'Weather Trading Agent' rather than the manifest-declared 'simmer' prediction market interface. This kind of identity mismatch is dangerous because it can indicate a repackaged, mislabeled, or substituted skill, undermining user trust, review accuracy, and downstream policy decisions about what the code is allowed to do.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs users to place a wallet private key into an environment variable for live trading but does not include clear guidance on secure handling, storage, shell history exposure, process inspection risk, or use of safer key-management options. Because this skill handles real funds on Polymarket, poor credential hygiene could lead to wallet compromise and unauthorized trades or asset loss if the host environment is shared, logged, or otherwise exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest explicitly supports a WALLET_PRIVATE_KEY for self-custody trading but only describes when it is needed, not the sensitivity of the secret or the financial consequences of exposing it. In a trading skill, a leaked private key can enable unauthorized trades or loss of funds, and the absence of an explicit warning increases the chance that users provide or handle the credential insecurely.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python """ interval = "1m" limit = max(lookback_minutes + 1, 5) url = f"https://api.binance.com/api/v3/klines?symbol=BTCUSDT&interval={interval}&limit={limit}" data = _api_request(url, timeout=10) if not data or isinstance(data, dict): return None, None, None
Rp1
Low
- Category
- MCP Rug Pull
- Confidence
- 83% confidence
- Finding
The instruction to install 'simmer-mcp' without a pinned version creates a supply-chain and reproducibility risk. A future malicious or breaking package release could be pulled implicitly by users or agents, changing behavior or introducing compromise.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The console messages include both Ukrainian and Russian strings, effectively imposing a specific language/locale on users without opt-in. The file does not provide any mechanism to select language or explain that the skill is intended for a specific locale.
- Content
Static analysis
No suspicious patterns detected.