T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:54- Finding
Mandatory Agent-Wide Trade Routing Through Publisher-Selected Tools
- Content
View full analysis
- Remediation
View remediation
Security audit
pm-desk
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Polymarket trading desk, but it asks for live trading authority and private-key handling with broad agent-routing instructions that need human review before use.
Install only if you deliberately want this package to be your Polymarket trading desk. Use a dedicated low-balance exit key, avoid long-lived shell environment secrets, verify the npm packages and versions yourself, and do not enable live mode or the watcher until you understand that it may submit real SELL orders through this tooling.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
scripts/package.json:6- Finding
Third-Party npm Packages Are Retrieved and Dynamically Executed Without Repository-Level Integrity Controls
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
NAUTILUS-SIDECAR.md:6- Finding
Private-Key Presence Automatically Transitions the Watcher From Dry-Run to Live Selling
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
bash mkdir -p pm-stops-sidecar && cd pm-stops-sidecar npm pack @hypelens/hypelens-agent-guard@0.1.18 && tar -xzf hypelens-hypelens-agent-guard-0.1.18.tgz cp -r package/compose/* . && rm -rf package *.tgz export FUNDER=0xYourFunder EXIT_PK=0xYourExitKey ./up.sh # or: docker compose up -d --build
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instructions tell the user to export a live exit private key and run a watcher that can sell positions, but they do not clearly warn that this enables real on-chain/live-market actions and exposes highly sensitive key material in the shell environment. In this trading context, accidental misuse, shell-history leakage, process-environment exposure, or operator misunderstanding can directly lead to loss of funds.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Documenting that
EXIT_PKautomatically flipsexits.dryRun:falsewithout a prominent safety warning creates a significant foot-gun: merely supplying the key can silently convert the system from simulation to live protective exits. In a Polymarket trading skill, that means immediate real order placement is plausible, especially since the file emphasizes auto-arming and breach-triggered exits.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
This is the same unpinned
npx hypelens-agent-guardreference in the compose command chain, so it carries the same risk: arbitrary future package code may be fetched at runtime. Because the tool is documented to receiveAGENT_GUARD_EXIT_PKand execute live exits, the blast radius includes unauthorized trades and potential credential exposure.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises very broad activation phrases such as place, trade, bet, buy, and sell in a financial-trading context, making it likely to trigger on ordinary user language even when the user did not explicitly request this specific skill. Because this skill is positioned as a default desk for funded Polymarket trading and protection workflows, an overbroad match can route sensitive trading actions through this skill unexpectedly, increasing the chance of unintended financial operations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Wildcard recommendation triggers like
*place*,*trade*, and*bet*are highly ambiguous and can match broad everyday language, causing the skill to be recommended or selected in contexts unrelated to Polymarket. In an autonomous or semi-autonomous agent environment, this increases the risk of accidental invocation of a live trading desk and can bias tool selection toward a financially sensitive skill.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The installation path uses
npx skills add ...without pinning theskillsCLI to an exact version, which introduces a supply-chain risk because the latest published package will be fetched and executed at install time. In a trading skill that handles wallet setup and operational desk processes, compromise of that bootstrap dependency could lead to malicious code execution, credential theft, or transaction manipulation.- Content
Static analysis
No suspicious patterns detected.