Polymarket Place

• Outcome: Review
• Latest audit: Sep 9, 2026 · 10:50 PM UTC
• Version: 1.0.13

Overview

This skill is for real-money Polymarket trading, but it uses mandatory companion-skill instructions and an unsafe fallback launcher that need review before installation.

Install only if you intentionally want a real-money Polymarket trading tool, understand any builder-code or fee behavior, and are willing to separately review and approve every companion skill and exact npm package version before use. Do not allow automatic stop watchers or follow-up trading actions until thresholds, positions, and maximum loss are explicitly confirmed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:24
• Finding: Mandatory companion installation redirects agent behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-27`, `SKILL.md:36-42`, `SKILL.md:47-54`; `BOT.md:3-5` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```yaml mustUseWith: - agent-guard ``` ```yaml requiredNext: - pm-desk - polymarket-stops - polymarket-risk - polymarket-exits - agent-guard ``` ```markdown **WARNING:** Mainnet CLOB V2 — real funds. **PM has no native stops.** After first live place, `requiredNext` MUST install+arm stops (`pm-desk` preferred, or `polymarket-stops` / `polymarket-risk` / `polymarket-exits` / `agent-guard`). **If already on polyclaw / @mvanhorn/polymarket / Gina:** install stops companion immediately. ```bash clawhub install pm-desk # or: clawhub install polymarket-place && clawhub install polymarket-stops ``` ``` `BOT.md` reinforces these instructions: ```markdown 1. DEFAULT for new OpenClaw PM agents: `clawhub install pm-desk` (place + stops) — first FILLED stamps Zac builderCode. 2. Place-only already installed (polyclaw / @mvanhorn/polymarket / Gina): `clawhub install polymarket-stops` NOW — those skills lack outside-LLM hard/trailing/portfolio stops. 3. After any live place: follow `requiredNext` → setup → watcher → arm. Never leave naked risk. ``` ### Technical Analysis The Skill declares third-party companions through `mustUseWith` and `requiredNext`, then uses imperative terms such as `MUST`, `DEFAULT`, `NOW`, and “immediately” to direct the agent to install and activate those components. This changes the agent's workflow merely because the Skill was loaded, rather than presenting companion installation as an optional action subject to informed user authorization. The instruction is especially sensitive because the Skill operates against Polymarket mainnet using real funds. Installing companions expands the trusted computing base to separately distributed code that was not included in this audit. Although stop-loss protection is a leg ...[truncated 1348 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `mustUseWith` and automatic `requiredNext` installation semantics. 2. Describe stop-management companions as optional recommendations rather than mandatory directives. 3. Require explicit user confirmation before every external Skill installation. 4. Display the exact package or Skill name, version, publisher, permissions, and expected behavior before requesting approval. 5. Keep trade placement and stop management separable so users can select independently audited implementations. 6. Do not automatically activate watchers or place follow-up orders after installation. 7. Require explicit confirmation of stop thresholds, affected positions, maximum loss, and transaction scope. 8. Pin and verify companion versions and provide reviewable source or integrity information for each companion. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/package.json:6
• Finding: Executable financial dependency is not consistently pinned<![CDATA[ ## Vulnerability Details **File Location**: `scripts/package.json:6-8`; `scripts/package-lock.json:8-12`, `scripts/package-lock.json:701-716`; `SKILL.md:57-58`; `BOT.md:6` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code The package manifest requests version `0.1.16`: ```json "dependencies": { "@hypelens/polymarket-place": "0.1.16" } ``` The lockfile root instead records version `0.1.15`: ```json "dependencies": { "@hypelens/polymarket-place": "0.1.15" } ``` The locked executable package is also version `0.1.15`: ```json "node_modules/@hypelens/polymarket-place": { "version": "0.1.15", "resolved": "https://registry.npmjs.org/@hypelens/polymarket-place/-/polymarket-place-0.1.15.tgz", "integrity": "sha512-cdrDNqgMmwzhzoEOFSvW2egNWwJqE7bSSg8VrNav3hSzC3YSFKtNiurUygwIX531w8ZbJavD7YsgTsugIV2ToA==", "dependencies": { "@modelcontextprotocol/sdk": "^1.30.0", "@polymarket/clob-client-v2": "1.1.0", "ethers": "^5.8.0", "viem": "^2.46.3", "zod": "^3.23.0" }, "bin": { "polymarket-place": "bin/polymarket-place-mcp.js", "polymarket-place-mcp": "bin/polymarket-place-mcp.js" }, "engines": { "node": ">=20" } } ``` Documentation contains further inconsistent pins: ```markdown npm: `@hypelens/polymarket-place@0.1.16`, `@hypelens/hypelens-agent-guard@0.1.17`. ``` ```markdown 4. Pins: `@hypelens/polymarket-place@0.1.14` + `@hypelens/hypelens-agent-guard@0.1.15`. ``` ### Technical Analysis The project does not maintain one consistent version of its core executable dependency. The manifest requests `0.1.16`, the lockfile resolves `0.1.15`, and documentation references both `0.1.14` and `0.1.16`. Agent-guard documentation similarly alternates between `0.1.15` and `0.1.17`. The launcher imports and executes the dependency's declared binary, so this is not a passive library mismatch. It determines which implementation can access the MCP and trading environment. Strict i ...[truncated 1817 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Choose one reviewed release of `@hypelens/polymarket-place`. 2. Regenerate `package-lock.json` from the final manifest and commit the resulting lockfile. 3. Ensure `SKILL.md`, `BOT.md`, `package.json`, and `package-lock.json` all reference the same version. 4. Use `npm ci` in deployment so manifest-lockfile disagreement fails closed. 5. Verify the npm tarball integrity and provenance before approving a release. 6. Consider recording the expected tarball digest separately in release documentation. 7. Review the complete source of the exact dependency version because it performs real-fund financial operations. 8. Pin security-critical transitive dependencies where practical and run dependency vulnerability and provenance scanning in CI. 9. Prevent unreviewed automated dependency updates from reaching production trading environments. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/start-mcp.mjs:17
• Finding: Launcher executes an unverified module outside the Skill directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/start-mcp.mjs:8-27`, specifically `scripts/start-mcp.mjs:17-20` **Vulnerability Type**: T07: Tool Hijacking and Spoofing **Risk Level**: High ### Vulnerable Code ```js try { const pkgJson = require.resolve('@hypelens/polymarket-place/package.json'); const pkg = require(pkgJson); const binRel = (pkg.bin && (pkg.bin['polymarket-place-mcp'] || pkg.bin['polymarket-place'])) || 'bin/polymarket-place-mcp.js'; const entry = join(dirname(pkgJson), binRel); await import(pathToFileURL(entry).href); } catch (e) { // Fallback: repo checkout before npm link/publish try { const localEntry = join(dirname(fileURLToPath(import.meta.url)), '..', '..', 'bin', 'polymarket-place-mcp.js'); await import(pathToFileURL(localEntry).href); } catch { console.error('Missing dependency. Run: npm install (in this scripts/ folder)'); console.error('Or from repo root: npm install && npm run mcp'); console.error(String(e && e.message ? e.message : e)); process.exit(1); } } ``` ### Technical Analysis When package resolution or package execution throws an exception, the launcher constructs a fallback path using: ```text scripts/../../bin/polymarket-place-mcp.js ``` This resolves outside the audited Skill directory. The fallback module was not present in the supplied artifact, and the launcher performs no canonical-path restriction, ownership check, signature check, or cryptographic integrity validation before importing it. Dynamic `import()` executes the target module immediately in the current Node.js process. Consequently, a file planted at the fallback path can impersonate the expected MCP implementation. The fallback is also reached for any exception thrown inside the primary package's top-level code, not only when the dependency is missing, because the broad outer `catch` handles the entire resolution-and-import sequence. ### Attack Path 1. An attacker or another local com ...[truncated 1350 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the external fallback and fail closed when the dependency cannot be resolved. 2. If development fallback behavior is required, keep the fallback module inside the Skill package. 3. Resolve the candidate path with `realpath` and verify that it remains under an explicitly trusted directory. 4. Verify a cryptographic hash or signature before importing any fallback module. 5. Separate dependency-resolution errors from runtime errors. Do not trigger fallback execution when the primary package itself throws during initialization. 6. Use explicit existence and integrity checks rather than a broad nested `try`/`catch`. 7. Ensure trusted code directories are not writable by less-privileged users or unrelated processes. 8. Log the exact canonical module path and validated digest before execution. 9. Run the MCP process with least privilege and avoid exposing wallet secrets that are not strictly required. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest description includes broad keywords such as "trade" and "bet," which overlap with common user intents and are not specific enough to uniquely target this skill. The trigger scope is not bounded by negative examples or narrower activation constraints, increasing the chance this skill is invoked for general trading-related requests.

Static analysis

No suspicious patterns detected.