Security audit

Polyclaw

Security checks across malware telemetry and agentic risk

Overview

Polyclaw is a coherent autonomous trading skill, but it handles real-money trading, token deployment, social posting, and sensitive API keys with enough under-scoped credential exposure to warrant careful review.

Install only if you are comfortable giving this skill authority over real-money prediction-market trading, agent wallet/token deployment, and social posting. Use limited funds, rotate or revoke keys if exposed, avoid storing secrets in chat or agent memory, and verify the registration script sends credentials only to the intended Polyclaw API before funding an agent.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill instructs use of shell commands and curl-based API interactions but declares no permissions/capabilities metadata to signal that behavior up front. This weakens the trust boundary for operators and hosting frameworks, making it easier for a user to authorize a skill without realizing it can transmit secrets and initiate external actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared purpose understates several high-risk behaviors: handling operator and agent API keys, registering agents with an external service, and triggering real-money autonomous trading plus token-related on-chain activity. This mismatch can mislead users about the true security and financial exposure of enabling the skill.

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: The documented API scope includes Twitter OAuth and token storage in addition to autonomous prediction-market trading, which expands the blast radius from financial automation into social-account control. Combining trading authority and social-posting capabilities in one skill increases the chance that a compromised agent key or unsafe integration could be abused for spam, impersonation, or reputation attacks alongside financial actions.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill promotes autonomous trading but does not prominently warn near the description/quick-start that funding the agent causes automatic real-money trading and related external/on-chain actions. In this context, insufficient disclosure is dangerous because users may provide funds or credentials without understanding that live trading begins automatically.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The registration section describes creating the agent, wallet, onboarding, token deployment, and later states that trading starts automatically once funded, but the flow lacks a strong interstitial warning or opt-in gate. Because the skill handles real assets and autonomous execution, omission of explicit consent materially increases the risk of unintended financial loss.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: This endpoint accepts highly sensitive Polymarket trading secrets, yet the documentation provides no guidance on secure handling, storage, transmission minimization, or rotation. In a skill centered on autonomous trading, encouraging users or downstream agents to submit long-lived secrets without strong warnings materially increases the risk of credential leakage and account takeover.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The Twitter token storage endpoint appears to accept and store sensitive OAuth access and refresh tokens, but the documentation shows no Authorization requirement and gives no security warning. In context, this is more dangerous because the same platform can autonomously post trade-related content, so misuse of this endpoint could enable account hijacking, impersonation, or unauthorized posting tied to financial activity.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide explicitly instructs the agent to poll trades, resolutions, and performance activity and then publish updates to external social platforms, but it provides no constraints on what trading, account, or performance data is safe to disclose. In an autonomous agent context, this creates a real risk of oversharing sensitive operational details, portfolio information, timing signals, or account-linked metadata that could harm the operator or be abused by third parties.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide encourages autonomous trading, automatic exits, and routine execution behavior without clearly warning users that real money can be lost and that automated strategies can amplify errors, slippage, or bad assumptions. In a live prediction-market trading skill, omission of explicit financial-risk disclosures can mislead users into enabling unsafe automation or underestimating downside exposure.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script prints the full Agent API key to stdout in the final summary, which can expose a sensitive credential to terminal history, CI logs, shell session recording, or downstream wrappers. Because the key is required for all trading operations, disclosure could allow unauthorized monitoring or trading actions against the agent.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The machine-readable JSON block includes the full Agent API key, making credential leakage likely in automation contexts where stdout is captured by logs, orchestration systems, chat transcripts, or other tools. This is especially risky because the script itself encourages reuse of these outputs, increasing the chance of broad secret propagation.

Ssd 3

High

Confidence: 95% confidence
Finding: The script explicitly encourages storing sensitive credentials in 'agent memory' and includes them in machine-readable output, promoting unsafe secret handling patterns. In agentic or automated environments, memory, prompts, logs, and artifact stores are commonly accessible or replayed, so this guidance materially increases the chance of credential exfiltration and misuse.

External Transmission

Medium

Category: Data Exfiltration
Content: AGENT_AUTH="Authorization: Bearer {agentApiKey}" # Register agent (operator key) - deploys token + wallet automatically curl -X POST "$API/agents" -H "$OP_AUTH" -H "Content-Type: application/json" -d '{ "name": "YourAgent", "tokenSymbol": "YAGT", "config": { ... }
Confidence: 92% confidence
Finding: The skill sends operator-provided and agent-derived data, authenticated with sensitive bearer tokens, to an external API via curl. External transmission is expected for this product, but it remains security-relevant because compromise, logging, or mishandling of those credentials can lead to unauthorized trading, withdrawals via operator access, or account takeover within the service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/api-reference.md:25

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:270