nautilus-polymarket-stops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:26 AM UTC
• Version: 1.0.6

Overview

This skill is a real Polymarket stop-loss sidecar, but it asks users to run live trading code with private keys and includes extra trade-routing and attribution instructions that need review before installation.

Review this before installing. Use only a dedicated low-balance exit key, keep dry-run enabled until manually verified, avoid pasting private keys into shell history or compose files, and do not accept builder-attribution or entry-routing defaults unless you explicitly want that behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/package.json:6

Finding

Security-Critical Trading Operations Are Delegated to an Unreviewed Third-Party Package

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:50

Finding

Skill Instructions Introduce Undisclosed Financial Routing and Builder Attribution

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions tell users to disable dry-run mode and describe automatic breach-triggered exits without a strong, unavoidable warning that this causes irreversible live trades. Given the skill’s stated purpose is autonomous protective SELL execution on the same funder wallet as a live Nautilus node, the context makes the omission more dangerous because accidental activation can immediately affect real positions and funds.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · NAUTILUS-SIDECAR.md (reported line 17)May include surrounding context.

bash

mkdir -p pm-stops-sidecar && cd pm-stops-sidecar
npm pack @hypelens/hypelens-agent-guard@0.1.18 && tar -xzf hypelens-hypelens-agent-guard-0.1.18.tgz
cp -r package/compose/* . && rm -rf package *.tgz
export FUNDER=0xYourFunder EXIT_PK=0xYourExitKey
./up.sh
# or: docker compose up -d --build

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes commands for live trading operation and explicitly references wallet addresses and a private key variable (EXIT_PK) without clear warnings about financial loss, irreversible transactions, and secret-handling requirements. In a trading context, this is especially dangerous because a user or agent could move from dry-run to live execution and expose signing material without understanding the operational and security risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to enable live stop execution by supplying EXIT_PK, which is a sensitive private key used for protective trades, but it provides no warning about secure handling, storage, or exposure risks. In an agent or sidecar workflow, this omission increases the chance that operators pass the key via insecure CLI history, logs, shell environments, or checked-in config files, which could lead to wallet compromise and unauthorized trading.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest presents this skill as a NautilusTrader Polymarket stop-loss sidecar for use beside a live Nautilus node, but this file documents use with @elizaos/plugin-polymarket and says no Eliza plugin rewrite is needed. That broadens the apparent supported integration context beyond NautilusTrader and suggests behavior or usage scope inconsistent with the stated manifest purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation instructs users to enable live exits by setting AGENT_GUARD_EXIT_PK and disabling dry-run mode, but it provides no warning about secure private-key handling, blast radius, or the fact that this can trigger real trades. In a trading sidecar context, encouraging direct use of a live trading private key without operational safeguards increases the risk of credential exposure, accidental live execution, and financial loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document gives copy-paste instructions to export a private key capable of executing live SELL orders, but it does not prominently warn about key-handling risks, wallet compromise implications, or the fact that this enables automated market actions. In a trading sidecar context, this is especially dangerous because users may paste a production key into shells, histories, logs, or shared environments and unintentionally authorize real fund movements.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The compose example automates setup and watcher startup with an exit key in environment variables, which can lead directly to unattended live protective SELLs. In this context, combining a hot key, automated execution, and same-wallet operation with a live trading system materially raises operational and financial risk if the example is run as-is or if environment variables leak via process inspection, compose files, or deployment tooling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises very broad invocation keywords and aliases across Nautilus, Polymarket, stops, compose, and MCP, which can cause an agent to activate it in contexts broader than intended. Because the skill performs trading-adjacent setup and can lead users toward wallet-linked execution paths, overbroad activation increases the chance of unintended use in sensitive financial workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.