Polymarket Worldcup Copytrader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:24 AM UTC
• Version: 0.1.2

Overview

This is a disclosed automated trading skill, but its unpinned SDK install path is risky because future unreviewed code could run with trading credentials.

Review this carefully before installing for live trading. Prefer running only in sim/dry-run first, use a dedicated environment with only the required Simmer/Polymarket credentials, and pin or lock simmer-sdk to a reviewed version before allowing live Polymarket trades.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Security-Critical SDK Dependency

Content

View full analysis

Vulnerability Details

File Locations:

• requirements.txt:1
• SKILL.md:55-58
• clawhub.json:10-13

Vulnerability Type: Unbounded third-party dependency installation
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text

simmer-sdk>=0.17.27

SKILL.md:55-58:

bash

# Install the Simmer SDK (0.17.27 or newer):
pip install -U 'simmer-sdk>=0.17.27'

clawhub.json:10-13:

json

"pip": [
  "simmer-sdk>=0.17.27"
]

Technical Analysis

The project specifies only a minimum version of simmer-sdk, while the installation instructions additionally use pip install -U. Consequently, an installation or upgrade may retrieve any future version published under that package name. There is no exact version pin, upper version bound, package hash, or lock file ensuring that users execute the dependency version reviewed with this Skill.

This dependency operates in a security-sensitive context. copytrader.py imports SimmerClient, supplies it with SIMMER_API_KEY, performs authenticated API requests, invokes wallet-related redemption behavior, and delegates trade execution to client.trade(). In live Polymarket mode, the surrounding process may also contain WALLET_PRIVATE_KEY in its environment. A compromised or unexpectedly changed SDK release would execute within that same process and security context.

The issue is a supply-chain exposure rather than evidence that the currently available SDK version is malicious.

Attack Path

1. An attacker compromises the SDK publisher account, package repository, release pipeline, or another channel capable of publishing a future simmer-sdk release.
2. The attacker publishes a version newer than 0.17.27 containing malicious initialization, networking, signing, or trading logic.
3. A user follows the documented pip install -U 'simmer-sdk>=0.17.27' command, or the Skill manager resolves the manifest requirement during installation.
4. The package resolver installs the at ...[truncated 1112 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the SDK to an exact reviewed version:

text

simmer-sdk==0.17.27

2. Remove -U from normal installation instructions so installation does not silently upgrade to an unreviewed release:

bash

pip install 'simmer-sdk==0.17.27'

3. Generate a lock file containing transitive dependency versions and cryptographic hashes. Install with hash verification, such as:

bash

pip install --require-hashes -r requirements.lock

4. Keep requirements.txt, SKILL.md, and clawhub.json synchronized so every installation path resolves the same reviewed version.

5. Review SDK release notes and source changes before upgrading. Update the exact pin and hashes only after testing credential handling, endpoint destinations, order signing, and trading behavior.

6. Run the Skill under a dedicated, least-privileged operating-system account. Supply WALLET_PRIVATE_KEY only for live external-wallet operation and avoid exposing unrelated credentials to the process.

7. Prefer an isolated virtual environment and restrict outbound network access to the documented Simmer and required Polymarket endpoints where operationally feasible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill uses sensitive environment variables such as SIMMER_API_KEY and WALLET_PRIVATE_KEY, but the manifest declares no explicit tool scope or permissions boundary. In an agent platform, missing scope metadata weakens policy enforcement and makes it harder to constrain or review secret access for a skill that can also execute live trades, increasing the chance of over-privileged execution or unintended secret exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tests/test_copytrader.py (reported line 368)May include surrounding context.

python

if "wc/copy-leaders" in path:
                raise Exception(
                    "503 Server Error: Service Unavailable for url: "
                    "https://api.simmer.markets/api/sdk/wc/copy-leaders")
            return {}

        mock_client._request.side_effect = _raise_503

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tests/test_copytrader.py (reported line 425)May include surrounding context.

python

if "wc/copy-leaders" in path:
                raise Exception(
                    "503 Server Error: Service Unavailable for url: "
                    "https://api.simmer.markets/api/sdk/wc/copy-leaders")
            return {}

        mock_client._request.side_effect = _raise_503

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · tests/test_copytrader.py (reported line 1025)May include surrounding context.

python

if "wc/copy-leaders" in path:
                raise Exception(
                    "503 Server Error: Service Unavailable for url: "
                    "https://api.simmer.markets/api/sdk/wc/copy-leaders")
            return {}

        mock_client._request.side_effect = _raise_503

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency is specified with only a lower bound, so future installs may pull newer simmer-sdk versions that were never tested with this skill. If the upstream package is compromised or introduces unsafe behavior, consumers of the skill could receive malicious or breaking code through normal installation.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

simmer-sdk>=0.17.27

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_copytrader.py:144