Polymarket Fast Loop

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:10 AM UTC
• Version: 0.1.0

Overview

This skill is purpose-built for real automated Polymarket trading, but it handles wallet/API credentials and installs an unpinned trading SDK, so it needs careful review before use.

Install only if you are comfortable giving this skill automated trading authority. Use dry-run first, keep live trade sizes and daily budget low, prefer a dedicated wallet with limited funds, avoid broadly exposing `WALLET_PRIVATE_KEY`, and pin/review the `simmer-sdk` dependency before running live or on a cron loop.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:2
• Finding: Unpinned Third-Party SDK Operates in a Credential-Bearing Trading Process## Vulnerability Details **File Location**: `SKILL.md:2`, with credential-handling context at `SKILL.md:50-58` and SDK initialization at `fastloop_trader.py:235-248` **Vulnerability Type**: Unpinned third-party dependency with access to financial credentials **Risk Level**: High ### Vulnerable Code `SKILL.md:2`: ```yaml metadata: {"clawdbot":{"emoji":"⚡","requires":{"env":["SIMMER_API_KEY"],"pip":["simmer-sdk"]},"cron":null,"autostart":false,"automaton":{"managed":true,"entrypoint":"fastloop_trader.py"}}} ``` Credential setup documented at `SKILL.md:50-58`: ```markdown 1. **Ask for Simmer API key** - Get from simmer.markets/dashboard → SDK tab - Store in environment as `SIMMER_API_KEY` 2. **Ask for wallet private key** (required for live trading) - This is the private key for their Polymarket wallet (the wallet that holds USDC) - Store in environment as `WALLET_PRIVATE_KEY` - The SDK uses this to sign orders client-side automatically — no manual signing needed ``` SDK loading and API-key delivery at `fastloop_trader.py:235-248`: ```python def get_client(live=True): """Lazy-init SimmerClient singleton.""" global _client if _client is None: try: from simmer_sdk import SimmerClient except ImportError: print("Error: simmer-sdk not installed. Run: pip install simmer-sdk") sys.exit(1) api_key = os.environ.get("SIMMER_API_KEY") if not api_key: print("Error: SIMMER_API_KEY environment variable not set") print("Get your API key from: simmer.markets/dashboard → SDK tab") sys.exit(1) venue = os.environ.get("TRADING_VENUE", "polymarket") _client = SimmerClient(api_key=api_key, venue=venue, live=live) return _client ``` ### Technical Analysis The Skill declares `simmer-sdk` without an exact version, integrity hash, lock file, or verified ...[truncated 2722 chars]
• Remediation: ## Remediation Suggestions 1. Pin `simmer-sdk` to a reviewed exact version rather than accepting the latest available release. 2. Use a lock file with cryptographic hashes, such as a hash-locked requirements file generated by `pip-tools`. 3. Install only from an explicitly trusted package index and verify package provenance, publisher identity, and release signatures where available. 4. Review SDK updates before changing the pinned version, including dependency-tree and source-diff analysis. 5. Separate wallet signing from the market-analysis process. Prefer a restricted signing service, hardware-backed signer, or wallet interface that does not expose the raw private key to Python dependencies. 6. Apply wallet and API restrictions where supported, including limited allowances, withdrawal restrictions, per-order limits, and short-lived or narrowly scoped credentials. 7. Run the trading process under a dedicated, unprivileged operating-system account with minimal filesystem and network access. 8. Restrict outbound network destinations to the documented Binance, Polymarket, and Simmer endpoints so unexpected credential-exfiltration destinations are blocked. 9. Avoid storing `WALLET_PRIVATE_KEY` directly in a broadly inherited process environment when a safer secret-delivery or signing mechanism is available. 10. Add dependency scanning and provenance verification to release and installation workflows.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill requests and uses sensitive capabilities implicitly: environment secrets (`SIMMER_API_KEY`, `WALLET_PRIVATE_KEY`), network access to external APIs, and likely file writes via configuration changes, but it does not declare any explicit tool scope or allowed-tools boundary. In an agentic runtime, this weakens least-privilege enforcement and can allow the skill to access more capabilities than reviewers or users expect, which is especially risky here because the skill performs live financial trading and handles a wallet private key.

External Transmission

Medium

• Category: Data Exfiltration

Content

Returns: {momentum_pct, direction, price_now, price_then, avg_volume, candles}
    """
    url = (
        f"https://api.binance.com/api/v3/klines"
        f"?symbol={symbol}&interval=1m&limit={lookback_minutes}"
    )
    result = _api_request(url)

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.