ClawHub
Back to skill

Security audit

Polymarket Clob Microstructure

Security checks across malware telemetry and agentic risk

Overview

Review before installing: this is a disclosed automated trading skill, but live mode can place repeated financial trades using a Simmer API key without a per-trade confirmation step.

Install only if you trust the publisher and understand that live mode can spend real funds automatically. Start in dry-run or simulation mode, use a scoped and revocable Simmer API key, set conservative trade-size and max-trade environment variables, and do not enable live cron execution unless you have independently reviewed the strategy and accept repeated automated trading risk.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script can place real trades whenever it is invoked with --live, with no execution-time confirmation, approval workflow, or secondary safeguard. In an agent or automation context, that creates a meaningful risk of unintended financial actions from misconfiguration, prompt/command injection in surrounding orchestration, or accidental invocation.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal