Security audit

polymarket-copytrading

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed Polymarket copytrading tool, but its reactor mode can place live automated trades without requiring a separate live-trading confirmation flag.

Review this carefully before installing. Use paper trading or polling dry-run first, avoid storing a wallet private key unless you intend live self-custody trading, and do not enable reactor cron or loop mode unless you accept automated live trades and have set conservative caps in Simmer.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs users to provide and store sensitive credentials such as `SIMMER_API_KEY` and `WALLET_PRIVATE_KEY`, and it performs outbound API calls, but it does not declare any permissions or explicitly bound those capabilities. In an agent ecosystem, undeclared environment and network access weakens reviewability and can lead to over-privileged execution or secret exposure through downstream tools and prompts.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation guidance is broad enough that ordinary user requests like asking what a wallet holds or asking to follow wallets could trigger the skill without clear confirmation boundaries, including in contexts that may lead to live trading. In a financial-trading skill that can access wallet credentials and execute orders, ambiguous invocation increases the risk of unintended execution or oversharing of sensitive portfolio data.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The example conversations include generic phrases that map directly to commands, which can encourage automatic execution from casual language without a robust consent checkpoint. Because this skill can transition from analysis to real-money trading and may use stored private keys, over-broad examples materially raise the chance of accidental activation with financial consequences.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: In reactor mode, the script explicitly bypasses dry-run behavior and executes live trades as soon as signals are received. For an automated trading skill that can route to real-money Polymarket venues, this increases the chance of unintended financial actions from operator misunderstanding or misconfiguration, especially because there is no additional arming/confirmation gate for this high-risk mode.

Unpinned Dependencies

Low

Category: Supply Chain
Content: simmer-sdk>=0.11.1 packaging>=20
Confidence: 93% confidence
Finding: simmer-sdk>=0.11.1

Unpinned Dependencies

Low

Category: Supply Chain
Content: simmer-sdk>=0.11.1 packaging>=20
Confidence: 90% confidence
Finding: packaging>=20

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_venue_routing.py:124