Security audit
Security checks for vulnerabilities and agentic risk
This skill is not destructive or exfiltrating data, but it presents mock trading signals as Polymarket edge detection, which could mislead users making financial decisions.
Review this skill carefully before installing. It appears safe from a local system security perspective, but its outputs should be treated as demo/mock data only and not as real betting or trading advice unless the implementation is changed to use verified live market and reference sources with clear labeling.
The skill advertises live Polymarket edge detection using external reference probabilities, liquidity, and historical accuracy, but the finding indicates those core functions are simulated with mock or randomly generated data. In a trading context, this can mislead users into making real-money decisions based on fabricated signals, creating financial harm and false trust in the tool's outputs.
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The module docstring explicitly states that the script finds mispriced binary contracts on Polymarket and compares market price to an external reference probability. That directly conflicts with the implementation, which uses a hardcoded market list and randomized synthetic values rather than external or Polymarket-derived data.
The manifest and module docstring describe an edge detector that compares Polymarket binary-option prices with external references such as polls, prediction APIs, or market-implied odds. In practice, the implementation never queries Polymarket or any external reference source; instead, it fabricates prices, reference probabilities, liquidity, and dates using a PRNG in fetch_mock_market.
No suspicious patterns detected.
