Polymarket Candle Momentum

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:09 AM UTC
• Version: 1.0.0

Overview

This is a disclosed trading skill, but it should be reviewed because live trades can proceed when a safety check fails and its trading dependencies are not pinned.

Install only if you are comfortable reviewing and controlling a live trading script. Keep it in dry-run first, use a tightly limited Simmer API key, avoid unattended cron until the fail-open context check is fixed, set conservative position limits, and pin/review dependencies before live use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:4

Finding

Security-Sensitive Third-Party Dependencies Are Unpinned

Content

View full analysis

Remediation

View remediation

simmer-sdk== ``` 2. Generate a hash-locked requirements file using a tool such as `pip-compile --generate-hashes`. 3. Install with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 4. Lock and review transitive dependencies rather than controlling only direct packages. 5. Verify package publisher identity and provenance before updates. 6. Run dependency vulnerability and integrity scanning in CI. 7. Test dependency updates in an isolated environment before publishing a new Skill version. 8. Where supported, restrict the trading API key to the minimum account permissions and financial limits required by this Skill. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: candle_momentum.py:95

Finding

Live-Trading Safety Validation Fails Open When Context Retrieval Fails

Content

View full analysis

0.15: return False, "slippage too high" edge = ctx.get("edge_analysis", {}) if edge.get("recommendation") == "HOLD": return False, "edge below threshold" return True, "ok" except Exception: return True, "context unavailable" ``` That approval directly gates the live-trading operation: ```python ok, reason = check_context(client, market_id) if not ok: if not quiet: print(f" Skipping trade: {reason}") return {"action": "skip", "reason": reason} try: result = client.trade( market_id=market_id, side=side, amount=amount, venue=os.environ.get("TRADING_VENUE", "polymarket"), source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=full_reasoning, ) ``` ### Technical Analysis `check_context()` is intended to prevent trades when the service reports severe signal reversal, excessive slippage, or inadequate edge. However, its broad `except Exception` handler converts every context failure into `(True ...[truncated 2076 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'api_key' from os.environ.get (line 231, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · candle_momentum.py (reported line 232)May include surrounding context.

python

"""Find active fast markets for the configured asset via Simmer REST API."""
    try:
        api_key = os.environ.get("SIMMER_API_KEY", "")
        resp = requests.get(
            f"{SIMMER_API_BASE}/api/sdk/fast-markets",
            headers={"Authorization": f"Bearer {api_key}"},
            params={

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documentation describes capabilities that use environment access and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent framework, this creates an authorization ambiguity where a reviewer or runtime may not clearly constrain what the skill is allowed to access, increasing the risk of over-broad execution or accidental privilege use.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

- Only `SIMMER_API_KEY` is read from environment. Nothing else.
- No host files are read. No logs written outside the script's own stdout.
- `automaton.managed` is `false` - the skill does not auto-execute.
- Dry-run by default. `--live` must be passed explicitly.

## Trade Execution Path

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file claims configuration occurs via environment variables only and that there is no local file persistence, but it also documents a '--set KEY=VALUE' command that appears to update configuration. This inconsistency can hide persistent state changes from users and reviewers, which is dangerous in trading automation because it can silently alter thresholds, position sizing, or live-trading behavior across runs.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · candle_momentum.py (reported line 33)May include surrounding context.

python

TRADE_SOURCE = "sdk:polymarket-candle-momentum"
SKILL_SLUG = "polymarket-candle-momentum"

BINANCE_KLINES_URL = "https://api.binance.com/api/v3/klines"

ASSET_SYMBOLS = {
    "BTC": "BTCUSDT",

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description explicitly narrows the skill to five assets scanned simultaneously. The code's asset symbol table adds DOGE, ADA, and AVAX, and the runtime config supports selecting arbitrary listed assets, expanding the skill beyond the stated scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Trades are submitted with source set to "sdk:polymarket-candle-momentum", but position lookup uses source="candle-momentum". This contradicts the code's own stated source identity and means the documented 'show current fast market positions' behavior may not actually show positions created by this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.