Security audit
Security checks for vulnerabilities and agentic risk
This paper-trading skill is mostly coherent, but it gives the agent autonomous local trading behavior and includes an ambiguous instruction to post leaderboard data through the user's GitHub CLI.
Install only if you are comfortable with an agent autonomously making paper trades and maintaining local trading history. Before allowing leaderboard or social-sharing workflows, require confirmation, especially for any action that would use your GitHub CLI or post public content. Consider pinning the package version before installation.
The skill instructs users to run uvx --from polymarket-paper-trader pm-trader-mcp without pinning an exact version or immutable source. That creates a supply-chain risk: a future compromised or malicious package release could be pulled and executed automatically by the agent environment, leading to arbitrary code execution during install or runtime startup.
The skill tells the agent 'When you're activated for the first time, do this' and later says 'Don't ask ... — trade', but it does not define a narrow, explicit activation trigger or require user confirmation. In an agent ecosystem, this can cause autonomous side effects on invocation, including account initialization, trading actions, and content generation without clear consent.
The phrase "uses public Polymarket API only (read-only)" suggests a read-only overall capability. However, the documented toolset includes write-like behaviors unrelated to merely reading Polymarket data, including buy/sell simulation, resetting accounts, generating leaderboard submissions, and content intended for external posting; this contradicts the stated intent of being purely read-only.
The documentation states that data 'stays local' and is 'never uploaded', but elsewhere the skill explicitly encourages generating shareable cards, posting to X, and submitting leaderboard data externally. This mismatch can mislead users about privacy boundaries and cause them to disclose trading history or account statistics under false assumptions.
The instruction to generate a stats card in format="tweet" implies a specific social-media-oriented language/locale output mode without offering the user a language choice. This can violate language/locale policy when the user has not opted into English or that platform-specific communication style.
The sharing instructions prescribe tweet output and provide example posts and hashtags aimed at X/Twitter, but do not offer any language or locale selection. This is a natural-language policy concern because the skill steers user-facing content into a presumed default language/context without opt-in.
No suspicious patterns detected.
