polymarket-sdk

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:04 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Polymarket trading helper, but it gives an agent live financial trading capabilities with incomplete safety scoping and an unpinned SDK install.

Review this skill before installing if you plan to use trading features. Use a pinned, reviewed SDK version in an isolated environment, provide limited-scope Polymarket credentials where possible, and require explicit confirmation for every state-changing action including placing, modifying, canceling, cancel-all, and close-position operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party SDK Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-16
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

The skill instructs the agent to install the Polymarket SDK directly from the default Python package index without pinning a version, verifying package hashes, or using a dependency lockfile:

markdown

## Setup

Ensure the SDK is installed:
```bash
pip install polymarket-us

text

### Technical Analysis

The command installs the latest package version available under the `polymarket-us` name, along with its transitive dependencies. The project does not specify an audited version, cryptographic hashes, a trusted package source, or a reproducible dependency manifest.

Python package installation can execute package build and installation logic. Runtime code from the installed SDK is also entrusted with the Polymarket API key identifier and Ed25519 private signing key documented elsewhere in the skill. Consequently, a compromised upstream release, package-index account, or transitive dependency could execute attacker-controlled code and access sensitive trading credentials.

This finding does not establish that the current `polymarket-us` package is malicious. It identifies an unsafe dependency acquisition practice that leaves future installations exposed to upstream or package-distribution compromise.

### Attack Path

1. An attacker compromises the package publisher, package-index account, release pipeline, or a transitive dependency.
2. The attacker publishes a malicious version that remains compatible with the unpinned package name.
3. An agent follows the skill instructions and runs `pip install polymarket-us`.
4. Pip selects and installs the attacker-controlled release because no approved version or hash is enforced.
5. Malicious installation or runtime code executes in the agent's Python environment.
6. When authenticated functionality is used, the compromise
...[truncated 934 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the SDK to a specifically reviewed version, for example with an exact == constraint.
2. Generate and maintain a lockfile that fixes all transitive dependency versions.
3. Require cryptographic package hashes, such as through a hash-locked requirements file and pip install --require-hashes.
4. Verify that the package originates from the official publisher and document the expected package index and provenance.
5. Review new SDK versions and their dependency changes before updating the approved pin.
6. Install the package in an isolated virtual environment or container under an unprivileged account.
7. Use trading credentials with the minimum permissions available, rotate them after suspected dependency compromise, and avoid exposing unrelated secrets to the process.
8. Where feasible, validate order details immediately before submission and enforce transaction limits independently of the SDK.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation exposes authenticated account, portfolio, and order-placement/cancellation capabilities without any explicit warning that these actions can move funds, open positions, close positions, or cancel active orders. In an agent skill context, this omission increases the chance that an agent or user invokes high-impact trading operations without informed confirmation, especially because both read-only and state-changing methods are presented together in a neutral quick-reference style.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.