Security audit

polymarket-exits

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Polymarket stop-loss sidecar, but it asks users to run automated live trading code with wallet-selling authority while leaving important scope and trust boundaries under-explained.

Install only if you intentionally want an automated Polymarket exit watcher. Use a dedicated least-privilege wallet or proxy with limited funds, start in dry-run, inspect the generated policy before enabling live exits, avoid pasting private keys into shell history or logs, run it in an isolated account/container, and treat the external @hypelens/hypelens-agent-guard package as part of the trusted computing base.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: scripts/setup.mjs:11
Finding: Security-Critical Wallet Operations Are Delegated to Unreviewed Third-Party Executable Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.mjs:14
Finding: Fallback Dynamic Imports Can Execute Code Outside the Skill Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (8)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · NAUTILUS-SIDECAR.md (reported line 17)May include surrounding context.
bash
mkdir -p pm-stops-sidecar && cd pm-stops-sidecar npm pack @hypelens/hypelens-agent-guard@0.1.17 && tar -xzf hypelens-hypelens-agent-guard-0.1.15.tgz cp -r package/compose/* . && rm -rf package *.tgz export FUNDER=0xYourFunder EXIT_PK=0xYourExitKey docker compose up -d --build

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The lockfile includes ws 8.18.0, which the provided advisories mark as affected by memory disclosure and memory-exhaustion denial-of-service issues. This is more concerning in this skill because its dependency set includes MCP/server components and websocket-capable libraries, so a network-facing sidecar or watcher could expose the vulnerable code path to remote attackers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instructions ask the user to export AGENT_GUARD_EXIT_PK, explicitly noting it 'can SELL funder positions', but do not provide a prominent security warning on key handling, key scope, irreversible order placement, or safe secret storage. In this context, the private key is not just sensitive data; it directly authorizes market actions, so accidental exposure or misuse can lead to immediate financial loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The quick-start directs users to set exits.dryRun: false and then run the watcher, enabling automatic live exits without a prominent caution about immediate order placement, strategy validation, false triggers, or market/liquidity risks. Given the skill’s purpose is autonomous stop execution on Polymarket, this omission is especially dangerous because users may activate live trading behavior from a copy-paste flow without understanding the consequences.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: The same unpinned npx hypelens-agent-guard reference appears twice in the compose command chain, so both setup and watcher execution are subject to runtime package substitution. Because this sidecar is explicitly designed to automate market exits and consume EXIT_PK, the blast radius is larger than a normal dev-tool fetch: malicious code could execute with credentials capable of trading.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises extremely broad trigger terms and recommendation phrases such as generic polymarket, trading, place, and risk-related keywords, plus wildcard-style matching. In an agent ecosystem, this can cause the skill to be invoked or recommended in many loosely related contexts, increasing the chance that a high-impact trading sidecar is installed or run without deliberate user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The natural-language instruction 'Never trade 0x9548…' imposes an unexplained hard constraint. Because no justification, scope, or opt-in is provided, it reads as an arbitrary policy-like restriction embedded in the skill text.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: elliptic==6.6.1 — 1 advisory(ies): CVE-2025-14505 (Elliptic Uses a Cryptographic Primitive with a Risky Implementation)

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: The lockfile pins elliptic 6.6.1, which is flagged by the provided advisory as using a risky cryptographic primitive implementation. In this file it appears only as a transitive dependency under ethers signing-related packages, so the issue is real at the dependency level but the practical exposure depends on whether the skill actually performs affected cryptographic operations with attacker-influenced inputs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.