T05 · Unauthorized Access and Privilege Escalation
Error
- Location
skill.md:175- Finding
Transmission of Derived Polymarket Trading Credentials to an External Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Polymarket Weather Bands
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly for automated Polymarket trading, but it asks for a raw wallet private key and can approve token spending and place trades without per-transaction confirmation.
Review this carefully before installing. Use only a dedicated low-balance wallet, assume the private key can control all assets in that wallet, and avoid running it unless you are comfortable with automatic token approvals, external registration of trading credentials, and market orders without a final confirmation prompt.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
skill.md:79- Finding
Autonomous Token Approval and Financial Trading Without Explicit Confirmation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:169- Finding
Unsafe Collection and Handling of a Raw Wallet Private Key
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
skill.md:33- Finding
Unpinned Security-Critical Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Missing User Warnings
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The required-inputs section asks for a wallet private key without clearly warning that this gives the skill full control over the wallet and the ability to derive credentials, approve spenders, and place trades. Requesting raw private keys is highly sensitive and materially increases the risk of asset theft, unauthorized transactions, or irreversible fund loss if mishandled by the agent or surrounding platform.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly authorizes automatic approval and trade execution without requiring explicit user confirmation immediately before financially consequential actions. In a trading context, this can cause unintended token approvals and market orders using real funds, especially if the user misunderstood defaults or the agent selected an unsuitable market.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The top-level behavior includes automatic allowance approval and post-submission trade handling, meaning the agent may authorize token spending and execute real trades without a final user checkpoint. In a live prediction-market setting, this can produce unintended on-chain approvals and financial loss from unwanted positions or excessive allowance scope.
- Content
md After the user provides AION API key and wallet private key, the agent should automatically derive wallet and CLOB credentials, register them, inspect the hottest active weather markets, choose a suitable market, check USDC balance, check Polygon gas, check allowances, auto-approve when allowance is missing, prefer a market order with a default 2 USDC spend, and verify the actual trade result from Polymarket after submission.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The scope section normalizes automatic approval when allowance is insufficient, which is a state-changing blockchain action with spending implications. Combined with automated market selection and order placement, this materially increases the chance of unauthorized or poorly understood financial actions.
- Content
md - Auto-derive wallet address and Polymarket CLOB credentials - Auto-register wallet credentials with AION Market - Auto-check USDC balance, Polygon gas, and required allowance - Auto-approve if allowance is insufficient and gas is available - Fetch the hottest active weather markets from Polymarket - Auto-pick a suitable market and prefer a market buy order - Default to `2` USDC spend unless the user overrides size or requests a limit order
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Mandatory Rules 1. If either secret is missing, stop and ask for it. 2. Never ask the user to manually provide Polymarket API credentials. 3. After the private key is available, automatically perform wallet derivation, wallet registration, balance checks, gas checks, allowance checks, and approval when needed. 4. Show the selected market snapshot and final order parameters before submission, but do not block on confirmation unless the user explicitly requested manual confirmation mode. 5. Default to a market buy order.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 91% confidence
- Finding
This rule instructs the agent to automatically perform credential registration, balance checks, allowance checks, and approvals once a private key is available, reducing user oversight over sensitive account actions. In context, this autonomy is dangerous because it chains directly into approval and trading behavior using live financial credentials.
- Content
md 1. If either secret is missing, stop and ask for it. 2. Never ask the user to manually provide Polymarket API credentials. 3. After the private key is available, automatically perform wallet derivation, wallet registration, balance checks, gas checks, allowance checks, and approval when needed. 4. Show the selected market snapshot and final order parameters before submission, but do not block on confirmation unless the user explicitly requested manual confirmation mode. 5. Default to a market buy order. 6. Default spend is `2` USDC.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The execution policy explicitly instructs the agent to auto-approve a spender when allowance is insufficient, creating an on-chain authorization without mandatory human review. Because approvals can outlive a single trade and enable later token transfers by the spender, the impact extends beyond the immediate 2 USDC default order.
- Content
md 1. Derive wallet address and CLOB credentials from `WALLET_PRIVATE_KEY` 2. Register wallet credentials in AION Market if missing 3. Check USDC balance, Polygon gas, and allowance 4. Auto-approve the needed spender if allowance is insufficient 5. Fetch and rank hot weather markets 6. Show the selected market snapshot 7. Resolve defaults: `orderMode=market`, `orderSize=2`, `side=BUY`
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 95% confidence
- Finding
The failure-handling logic says to auto-approve and continue whenever allowance is insufficient and gas exists, reinforcing that the agent should silently recover by performing a privileged financial action. This makes the system more dangerous because approval is treated as routine error recovery rather than a separate consent boundary.
- Content
md - If balance is insufficient, stop and report the deficit - If gas is insufficient, stop and report the shortfall - If allowance is insufficient and gas exists, auto-approve and continue - If `get_market_context()` fails in sandbox, continue using direct market data and CLOB read-only validation as fallback - Never execute fallback orders directly through Polymarket SDK; trade and cancel actions must use AION API endpoints only - If SDK returns `tradeResult: null` or `INTERNAL_ERROR`, verify recent trades and open orders before reporting failure
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- skill.md:167