Polymarket Whale Tracker

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:27 PM UTC
• Version:
  1.0.0

Overview

This skill is a read-only Polymarket reporting tool that contacts Polymarket APIs and does not access credentials or place trades.

Install only if you are comfortable with the script contacting Polymarket API endpoints and sending any wallet addresses you query. Treat the output as market research, not as guaranteed trading advice or an automated trading system.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and requires live network access to fetch Polymarket leaderboard and wallet position data, but it does not declare any corresponding permissions. Undeclared network capability is a real security issue because it prevents users and hosting platforms from accurately understanding or constraining the skill’s external communication surface, which can enable unexpected data exfiltration, tracking, or interaction with untrusted remote services.

VirusTotal

66/66 vendors flagged this skill as clean.