Polymarket Mil Aircraft Tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.2.0

Overview

The skill is a disclosed trading automation tool, but some advertised financial safety controls are not reliably implemented.

Review this carefully before installing for live use. Dry-run and SIM mode are appropriate, but do not rely on the documented daily loss or region exposure controls as authoritative. For real funds, use a dedicated environment, narrowly scoped API keys, pinned dependencies, external account-level limits, and manual monitoring of open positions and P&L.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:126

Finding

Unpinned Security-Sensitive Trading SDK Installation

Content

View full analysis

=0.13.0 not installed. Run: pip install --upgrade simmer-sdk") sys.exit(1) ``` ### Technical Analysis The documented installation command retrieves and executes the latest available `simmer-sdk` release and its transitive dependencies without an exact version, lock file, or integrity hashes. This dependency is security-sensitive because the tracker imports it to create an authenticated client, inspect financial positions, and submit trades. It consequently operates in a process containing `SIMMER_API_KEY` and live trading authority. A compromised, malicious, or unexpectedly incompatible future package release could execute arbitrary code during installation or import. The project does not itself retrieve and execute arbitrary remote source code, but its unrestricted package installation guidance creates a supply-chain exposure. ### Attack Path 1. An attacker compromises the `simmer-sdk` package publisher, package-index account, or a future transitive dependency. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user follows the documented `pip install --upgrade simmer-sdk` instruction. 4. Package installation hooks or imported package code execute with the user's operating-system privileges. 5. The malicious package reads environment credentials, changes market selection or order parameters, submits unauthorized trades, or exfiltrates sensitive information. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of ...[truncated 483 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: milaircraft_tracker.py:28

Finding

Broad Ancestor Path Precedence Enables Python Module Shadowing

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: milaircraft_tracker.py:467

Finding

Daily-Loss Kill Switch Does Not Consume Authoritative Profit and Loss Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: milaircraft_tracker.py:344

Finding

Region Exposure Uses Stale Append-Only Position State

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code is only a low-level API client for pref.trade MCP. It supports calling tools, specifically retrieving military ADS-B aircraft and checking account status. The declared purpose describes an end-to-end trading skill that uses aircraft clustering in a region to trade Polymarket strike/action markets, but none of that behavior appears in this chunk. The account-status capability is also undeclared. While fetching military ADS-B data via pref.trade is consistent with part of the description, the primary declared behavior—triggering on regional clusters and executing trades—is absent, so this is a clear description/behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The autonomous setup snippet instructs the agent to register a new API key over the network and persist it locally in a credentials file. Auto-provisioning long-lived credentials from within a skill increases the risk of unauthorized account creation, secret sprawl, and later misuse if the host or agent environment is compromised, especially in a real-money trading context.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

import urllib.request
from pathlib import Path

cred = Path.home() / ".config" / "preference" / "credentials.json"
if cred.exists():
    raise SystemExit(f"credentials already exist: {cred}")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

from urllib.request import Request, urlopen

PREF_MCP_ENDPOINT = "https://pref.trade/mcp"
PREF_CREDENTIALS_PATH = Path.home() / ".config" / "preference" / "credentials.json"
_request_id = 0

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

from urllib.request import Request, urlopen

PREF_MCP_ENDPOINT = "https://pref.trade/mcp"
PREF_CREDENTIALS_PATH = Path.home() / ".config" / "preference" / "credentials.json"
_request_id = 0

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

from urllib.request import Request, urlopen

PREF_MCP_ENDPOINT = "https://pref.trade/mcp"
PREF_CREDENTIALS_PATH = Path.home() / ".config" / "preference" / "credentials.json"
_request_id = 0

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · pref_client.py (reported line 19)May include surrounding context.

python

from urllib.request import Request, urlopen

PREF_MCP_ENDPOINT = "https://pref.trade/mcp"
PREF_CREDENTIALS_PATH = Path.home() / ".config" / "preference" / "credentials.json"
_request_id = 0

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · pref_client.py (reported line 52)May include surrounding context.

python

from urllib.request import Request, urlopen

PREF_MCP_ENDPOINT = "https://pref.trade/mcp"
PREF_CREDENTIALS_PATH = Path.home() / ".config" / "preference" / "credentials.json"
_request_id = 0

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool scope even though the documented workflow requires environment access, filesystem reads/writes, and outbound network calls. In an agent ecosystem, missing scope declarations weaken least-privilege controls and can let a runtime grant broader capabilities than users expect, which is risky for a skill that handles API keys and trading actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill instructs creation of a persistent credentials directory and storage of an agent key under the user's home directory. Persistent session material on disk expands the blast radius of host compromise and can outlive the user's intent, which is especially sensitive for a skill capable of network access and real-money trading.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Agents do not need to use the human browser sign-up flow. If no pref key exists, register an agent key directly and save it to the standard credentials file:

bash

mkdir -p ~/.config/preference
python - <<'PY'
import json
import os

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

## Troubleshooting

**`PREF_API_KEY not set`** - create a pref.trade agent key with the autonomous setup command above, export it as `PREF_API_KEY`/`PREFERENCE_API_KEY`, or save it to `~/.config/preference/credentials.json`. Run `python milaircraft_tracker.py --check` before scanning.

**`SIMMER_API_KEY environment variable not set`** - get a key from `simmer.markets/dashboard`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This skill can place real buy and sell orders whenever it is run with --live, without any per-order interactive confirmation or secondary approval step. In a trading skill, that creates a genuine safety risk: operator error, bad upstream data from pref.trade, incorrect market matching, or unexpected strategy behavior can immediately translate into real financial loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code sends an Authorization bearer token to https://pref.trade/mcp, which is a sensitive network operation. Although the function has internal docstrings and error prints, there is no user-facing disclosure at the point of use that the skill will contact a remote service and transmit credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a skill that trades strike/action markets based on military aircraft clustering, and this file's main purpose is fetching military ADS-B data. Adding a separate get_account_status() capability introduces account introspection that is not necessary to detect aircraft clusters or retrieve market signal data, making it unjustified by the stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.