Security audit
Security checks for vulnerabilities and agentic risk
The skill is transparent about connecting to Manifold, but it can make live account-changing trades with the user's API key without an enforced confirmation step.
Install only if you are comfortable giving the skill access to your Manifold API key and having an agent operate your Manifold account. Treat bet, sell, and cancel as live actions, use dry runs for bets, and manually confirm exact market IDs, amounts, outcomes, and order IDs before allowing execution.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import requests
# Auto-load .env from data/ directory next to scripts/
_data_env = Path(__file__).resolve().parent.parent / "data" / ".env"
if _data_env.exists():
for line in _data_env.read_text().splitlines():
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
import requests
# Auto-load .env from data/ directory next to scripts/
_data_env = Path(__file__).resolve().parent.parent / "data" / ".env"
if _data_env.exists():
for line in _data_env.read_text().splitlines():
line = line.strip()
The skill exposes capabilities that can access environment variables, read files, and make network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity: an agent may invoke this skill with broader runtime powers than a reviewer or policy layer expects, which is especially sensitive here because the skill uses an API key and performs real trading actions over the network.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
v = v.strip().strip('"').strip("'")
os.environ.setdefault(k.strip(), v)
BASE = "https://api.manifold.markets/v0"
KEY = os.environ.get("MANIFOLD_API_KEY", "")
The script exposes live trading operations (bet, sell, cancel) that immediately act on the authenticated Manifold account once invoked, with no secondary confirmation, explicit danger banner, or default dry-run behavior. In an agent-skill context, this increases the risk of accidental or prompt-induced financial actions because an upstream agent or user misunderstanding can trigger irreversible account activity.