Polymarket via Gina

• Analyzed: May 12, 2026, 4:02 AM
• Findings: 1
• Version: 0.2.0
• Hash: 2397b946a5e19fd64f001a74e3b05967e1caafa062ce1d31bd44516203b6ed6e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to the 'Data analysis' feature described in SKILL.md, which allows the agent to 'fetch crypto markets into SQL' and 'run a query'. While presented as a legitimate feature, this capability, if implemented without robust input sanitization on the backend (askgina.ai), could potentially expose the system to SQL injection vulnerabilities. There is no direct evidence of malicious intent, data exfiltration, or prompt injection attempts against the agent itself. The skill also explicitly warns users about trading with real money and includes safety measures like confirmation for large trades and warnings against providing private keys, which are positive security indicators.