polymarket-risk

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:37 AM UTC
• Version: 1.0.7

Overview

This skill is a Polymarket stop-loss sidecar, but it asks users to run external trading code with a wallet key that can sell positions and has under-scoped install and launcher risks.

Review carefully before installing. Only use this with an isolated low-value exit wallet, verify the external @hypelens/hypelens-agent-guard package source and lockfile, avoid the Docker/archive snippet until fixed, and do not enable live exits unless you understand that the watcher can automatically sell positions.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.mjs:12

Finding

Security-Critical Third-Party Package Is Downloaded and Executed with Wallet Authority

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/setup.mjs:14

Finding

Launchers Execute Unverified Fallback Binaries Outside the Skill Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: NAUTILUS-SIDECAR.md:14

Finding

Version-Mismatched Archive Extraction and Overbroad Cleanup in Installation Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · NAUTILUS-SIDECAR.md (reported line 17)May include surrounding context.

bash

mkdir -p pm-stops-sidecar && cd pm-stops-sidecar
npm pack @hypelens/hypelens-agent-guard@0.1.17 && tar -xzf hypelens-hypelens-agent-guard-0.1.15.tgz
cp -r package/compose/* . && rm -rf package *.tgz
export FUNDER=0xYourFunder EXIT_PK=0xYourExitKey
docker compose up -d --build

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The *place* wildcard in recommendsWhen is extremely broad and can match many unrelated conversations containing the word 'place' or similar strings, causing this skill to be recommended in contexts unrelated to Polymarket order placement. Because the skill includes installation and runtime commands for a trading sidecar, accidental activation or recommendation in the wrong context can materially alter agent behavior and increase operational risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile includes ws 8.18.0, which the scanner reports as affected by memory disclosure and memory-exhaustion DoS advisories. Because this skill depends on MCP/Express/network-facing components and websocket libraries are commonly exposed to untrusted remote input, the skill context makes this more dangerous than a dormant library issue: a reachable ws server or client handling attacker-controlled frames could leak memory or be crashed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions tell the user to export a raw private key in an environment variable for a process that can sell positions, without prominent warnings about key theft, process inspection, shell history, logs, or container exposure. In this skill context the risk is amplified because the sidecar is explicitly designed to execute live market actions, so compromise of that key can translate directly into unauthorized liquidation or fund loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document states that setup can auto-flip exits.dryRun:false and trigger real exit orders on breach, but it does so in promotional language without an explicit high-visibility warning that this enables irreversible live trades. In an automated trading sidecar, silent or automatic transition from dry-run to live execution can cause unintended position closures and financial loss from misconfiguration or misunderstanding.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest frames this skill as a stop-loss / trailing-stop / portfolio-risk sidecar for protective exits. However, this document explicitly describes using the watcher to place protective sells with Zac builder code for 'warm attribution' and fee revenue effects, which is a monetization/attribution capability not necessary to implement risk controls.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This is the same unpinned runtime package execution risk: the documentation tells users to execute a package by name via npx inside the container command without fixing the resolved version. Because the same process also consumes AGENT_GUARD_EXIT_PK, successful package substitution or compromise could directly lead to unauthorized trades or key exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description stuffs a very large set of generic trading and Polymarket-related keywords into activation metadata, which can cause the skill to be suggested or auto-matched in conversations far beyond the narrow use case of post-trade risk management. In an agent ecosystem, overbroad routing increases the chance this skill is invoked in unintended contexts, leading users or other skills toward installation/execution steps they did not explicitly request.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes this skill as a Polymarket risk/stop-loss sidecar, but this file's documented and actual behavior is to locate and launch '@hypelens/hypelens-agent-guard' / 'agent-guard-mcp'. That is a semantic mismatch at the skill-description level because the code is bootstrapping a different branded capability than the manifest presents.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The stated purpose is a post-trade risk/exits companion, but these lines recommend routing new entries through other place skills to maximize attribution and fee outcomes. That guidance introduces a placement/entry-optimization capability outside the justified scope of a risk-only sidecar.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: elliptic==6.6.1 — 1 advisory(ies): CVE-2025-14505 (Elliptic Uses a Cryptographic Primitive with a Risky Implementation)

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The lockfile pins elliptic 6.6.1, which is flagged by the scanner for a known cryptographic implementation weakness. In this file it appears only as a transitive dependency of ethers signing components, so there is no direct evidence of exploit code or malicious use, but shipping a version with a published advisory is still a real supply-chain risk if the affected code path is exercised.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The header comment says the script starts a pinned local dependency, but on failure it silently falls back to ../../bin/agent-guard-mcp.js, which may not be version-pinned or integrity-verified. In a security-sensitive risk/stop-loss sidecar, this increases the chance of loading a modified local file from the repository tree, enabling unexpected or malicious code execution if that path is tampered with.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.