Polymarket Mil Aircraft Tracker

• Outcome: Review
• Latest audit: May 24, 2026, 2:45 PM
• Version:
  1.0.0

Overview

This skill is openly designed to trade with real money, but it allows live orders and disabling key safeguards with too little confirmation for a financial automation tool.

Install only if you are prepared for automated trading risk. Start in dry-run or TRADING_VENUE=sim, use small caps, keep wallet exposure limited, and do not use --live or --no-safeguards unless you fully understand the order behavior and possible losses.

SkillSpector (3)

By NVIDIA

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes capabilities that require environment access, file read/write, and network use, but it does not declare permissions. This creates a transparency and least-privilege problem: users and platforms cannot accurately assess what the skill will access before execution, which is especially significant because the skill handles API keys, persistent state, and live trading actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Passing --live enables immediate real-money trading with no secondary confirmation, preview, or interactive acknowledgement. In an agentic or automated environment, a mistaken invocation, prompt injection into surrounding orchestration, or unsafe default wrapper could cause unintended market orders and financial loss.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- **Per-trade cap.** `SIMMER_MILACFT_TRADE_SIZE` defaults to `$5.00` per trade.
- **Region exposure cap.** `SIMMER_MILACFT_CLUSTER_CAP` defaults to `$25.00` open exposure per region.
- **Daily kill switches.** `SIMMER_MILACFT_DAILY_LOSS_KILL` and `SIMMER_MILACFT_DAILY_TRADE_KILL` stop new entries after the configured limits.
- **Strategy-side safeguards.** The skill checks Simmer market context, slippage, resolved-market warnings, duplicate positions, and cluster state before orders. Disable only with `--no-safeguards`.
- **Reversibility.** Open positions exit when price rises above `SIMMER_MILACFT_EXIT_THRESHOLD`, or when the regional aircraft cluster drops below its threshold.

If anything above is unclear, stop before passing `--live`.

• Confidence: 90% confidence
• Finding: --no-safe

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.