Security audit

Polymarket Autopilot

Security checks for vulnerabilities and agentic risk

Overview

This skill looks more like a mock Polymarket report sender than a real trading autopilot, and it sends Discord messages to a hardcoded channel.

Review this carefully before installing. It does not appear to perform real Polymarket trading, but it can send generated reports to a preset Discord channel and write local status under a hardcoded path. Install only if you intend to use that Discord destination or are prepared to edit the configuration and script first.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description says the skill manages a portfolio and executes trades based on strategies. However, the concrete usage section for the provided skill file only lists getting market data, analyzing trends, generating reports, and pushing to Discord, with no documented trade execution or portfolio modification flow. This indicates the claimed behavior is broader than what the file actually substantiates.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises automated trading plus Discord reporting without clearly warning that it may act on external services and transmit data off-platform. In a finance-related context, users need explicit notice about unattended actions, account/API permissions, and outbound notifications because misunderstanding those behaviors can lead to unintended account activity or data exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Presenting scheduled execution as the recommended mode without a clear warning about unattended operation and outbound Discord messages is risky, especially for a trading-themed skill. Users may enable it expecting passive monitoring while it continuously sends reports or, if later extended, could act on market signals without active supervision.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level documentation lists capabilities such as obtaining Polymarket market data, analyzing market trends, and managing investments. The code contradicts this at L61 and L66-L71 by explicitly generating a report from simulated data, while no code accesses Polymarket or performs portfolio management.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code performs a file write to a persistent path under the user's home directory, which can affect local state, but the save operation has no user-facing disclosure at the point of action beyond a failure log. Under the rule, file writes in code should have some visible warning, confirmation, or documented disclosure unless clearly expected from the skill's stated purpose, and the header describes reporting and Discord push but does not explicitly warn about local state persistence.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest promises trend monitoring, portfolio management, and trade execution for a Polymarket autopilot. In this file, the core behavior is limited to building a report from hardcoded '模拟市场数据' and sending it to Discord, with no Polymarket API access, no real market monitoring, and no trade logic.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The title and feature sections present the skill as an AI system that automatically monitors and trades Polymarket. Yet the explicit behavior under manual execution is described only as fetching market data, analyzing trends, generating a report, and sending it to Discord, which contradicts the stronger 'auto trading' framing in the documentation. This is more than an omission because the operational description narrows behavior away from actual trading.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The natural-language instructions and headings are primarily Chinese, which may impose a language/locale constraint on users without opt-in. Under the policy, language restrictions should either provide a user choice or be clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The report timestamp is forced to use the zh-CN locale and Asia/Shanghai timezone, which is a natural-language/locale policy concern when not documented as region-specific or user-selectable. The file does not indicate that this skill is intentionally limited to that locale or provide an opt-in or configuration option.
Content: No source excerpt is available for this finding.