Polymarket Research

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.0.0

Overview

This skill is a read-only Polymarket research helper that uses a Simmer API key and SDK dependency, with no evidence of trading, persistence, or hidden behavior.

Before installing, use a Simmer API key with only the access needed for research, avoid exposing unrelated secrets to the runtime, and prefer pinning simmer-sdk to a reviewed version if your environment supports it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:6

Finding

Unpinned Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: clawhub.json:6
Additional Location: SKILL.md:20-23
Vulnerability Type: Unpinned package dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

clawhub.json:6:

json

"pip": ["simmer-sdk"]

SKILL.md:20-23:

bash

pip install simmer-sdk
export SIMMER_API_KEY="sk_live_..."

Technical Analysis

The project installs simmer-sdk without specifying an exact, reviewed version or verifying an integrity hash. Consequently, installations may resolve to different package versions over time. If the package distribution account, package registry, or a future release is compromised, package installation or subsequent import could execute attacker-controlled Python code.

This risk is especially relevant because research.py imports SimmerClient from the dependency and gives the resulting client the value of SIMMER_API_KEY. The audited project itself contains no confirmed malicious behavior, but its dependency declaration does not guarantee that the code installed in the future will be the same code that was reviewed.

Attack Path

1. An attacker compromises the package publisher, package distribution process, or registry entry for simmer-sdk.
2. The attacker publishes a malicious release under the same package name.
3. A user or managed installer processes the unpinned dependency declaration or follows the documented pip install simmer-sdk command.
4. The package manager retrieves the malicious release because no exact version or trusted hash is required.
5. Attacker-controlled code runs during package installation or when research.py imports and uses the package.
6. The malicious dependency reads SIMMER_API_KEY, manipulates research results, accesses other data available to the process, or executes commands under the user's account.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user installing o ...[truncated 556 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin simmer-sdk to an exact, reviewed version in the package metadata and installation documentation.

2. Generate a dependency lockfile containing cryptographic hashes for the package and all transitive dependencies.

3. Install dependencies with hash verification, such as:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Obtain packages only from an explicitly configured, trusted package index and document the expected publisher and source.

5. Review dependency updates before changing the pinned version, including source changes, release provenance, and transitive dependency changes.

6. Run the skill in a least-privileged environment with access only to the required API key and files.

7. Avoid exposing unrelated credentials to the process, and rotate SIMMER_API_KEY immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.