Security audit

polymarket-stops

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real Polymarket stop-loss sidecar, but it asks users to run live trading automation with signing-key access while relying on under-scoped install and execution paths.

Review this carefully before installing. Use only a dedicated, low-balance wallet, keep the watcher in dry-run until verified, avoid shell/container environment variables for private keys where possible, prefer lockfile-based installs over direct npx or runtime npm install, and confirm whether builder attribution is acceptable or configurable before enabling live exits.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/setup.mjs:10
Finding: Executable fallback paths escape the Skill trust boundary
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: NAUTILUS-SIDECAR.md:5
Finding: Documented workflows download and execute third-party npm code outside the committed lockfile
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: NAUTILUS-SIDECAR.md:5
Finding: Transaction-authorizing private key is exposed through shell and container environment variables
Content: View full analysis
Remediation: View remediation

other

Warning

Location: NAUTILUS-SIDECAR.md:21
Finding: Protective trades include unrelated third-party builder attribution
Content: View full analysis
0; ~1% taker ~19–20 Sep). ``` `NAUTILUS-SIDECAR.md:57-64`: ```text ## Optional: also warm entries (preferred for day-0 fee $) Route **new** entries through `@hypelens/polymarket-place` / `clawhub install pm-desk` so **entries + exits** attribute ($10k notional → $100 @ 1%; $50k → $500). Exit-only underperforms for W1–W3. For **new OpenClaw PM agents**: default to `pm-desk` (place stamps Zac code on first fill + stops). Do not start on place-only skills without stops. ``` `ELIZA-COMPANION.md:12-14`: ```text Or: `clawhub install polymarket-stops`. Protective SELLs stamp Zac builderCode. Prefer Nautilus sidecar discovery first (higher notional). Eliza volume unknown — treat as stretch until proven. ``` ### Technical Analysis The Skill is presented primarily as a stop-loss and risk-management sidecar. Its documentation states that protective SELL transactions are deliberately stamped with a named third party’s builder code and discusses attribution and fee-related benefits. Builder a ...[truncated 1636 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · NAUTILUS-SIDECAR.md (reported line 17)May include surrounding context.
bash
mkdir -p pm-stops-sidecar && cd pm-stops-sidecar npm pack @hypelens/hypelens-agent-guard@0.1.17 && tar -xzf hypelens-hypelens-agent-guard-0.1.15.tgz cp -r package/compose/* . && rm -rf package *.tgz export FUNDER=0xYourFunder EXIT_PK=0xYourExitKey docker compose up -d --build

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The lockfile includes ws 8.18.0, which is flagged for uninitialized memory disclosure and memory-exhaustion denial of service. This is a true dependency risk because package-lock.json determines the installed version, and this skill’s sidecar/MCP/networked architecture increases exposure if any component opens WebSocket connections or accepts untrusted peer traffic. For an always-on trading/risk sidecar, DoS can directly disable stop-loss or exit automation, making operational impact materially higher.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation tells users to run setup and watcher commands and explicitly notes a live mode using AGENT_GUARD_EXIT_PK with exits.dryRun:false, but it does not include strong warnings about real-money trading, key handling, environment isolation, or dry-run verification. In the context of a Polymarket stop-loss sidecar, these commands can directly enable automated exit behavior, so unclear guidance can lead to unauthorized or unintended live trades and private key exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation tells users to export AGENT_GUARD_EXIT_PK=0xYourExitKey and notes that it 'can SELL funder positions', but it does not provide a prominent credential-handling warning or emphasize that this enables real market actions. Exposing private keys via shell environment variables and encouraging immediate activation of live exits materially increases the chance of secret leakage, accidental live trading, and irreversible asset loss.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This is the same unpinned npx hypelens-agent-guard usage in the Docker compose command path, so the runtime may fetch and execute an unintended version. Because the sidecar is explicitly configured with AGENT_GUARD_EXIT_PK, the blast radius is larger than normal documentation drift: a malicious or compromised package could act with trading authority.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The compose example launches an automated watcher that can execute protective trades using AGENT_GUARD_EXIT_PK, but the example lacks a clear live-trading warning at the point of use. In this context, users may treat the snippet as routine infrastructure setup and unintentionally authorize a container to perform irreversible market actions with real funds.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises very broad activation terms and even includes a wildcard-style trigger (*place*), which can cause the agent to invoke this skill in contexts that only loosely match trading or order-placement workflows. In a trading environment, unintended invocation is risky because it may lead to unnecessary installation/setup steps, watcher startup, or risk-management actions being suggested or chained at the wrong time.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: elliptic==6.6.1 — 1 advisory(ies): CVE-2025-14505 (Elliptic Uses a Cryptographic Primitive with a Risky Implementation)

Low

Category: Supply Chain
Confidence: 83% confidence
Finding: The lockfile pins elliptic to 6.6.1, which is reported as having a risky cryptographic implementation. Even though this file is only dependency metadata, it confirms the vulnerable package would be installed transitively, so the issue is real at the supply-chain level. In this skill’s context, crypto libraries are relevant because dependencies like ethers and wallet functionality may process signing material, making flawed crypto primitives more concerning than in a non-crypto application.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.