Polymarket Trade 1.0.6

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:19 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Polymarket market viewer with optional local watchlist alerts and paper-trading records, not real trading or credential use.

Before installing, be comfortable with the skill fetching public Polymarket data and storing watchlist and paper-trading JSON files in ~/.polymarket. The cron examples and local state changes only happen if you run or configure those commands; it does not use wallets, API keys, or real-money trading.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented primarily as a market-query tool, but it also persists watchlists, tracks alerts, and manages a local paper-trading portfolio under ~/.polymarket/. This mismatch can mislead users and reviewers about stateful behavior and local data modification, which is risky because users may invoke it expecting read-only behavior when it actually writes files and maintains ongoing state.

Ae1

High

• Category: analysis-evasion

Content

Review `scripts/polymarket.py` before first use to verify behavior.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill uses network access and persistent local file reads/writes but does not declare any explicit tool scope or permissions boundary. That makes its real capabilities less transparent to users and the hosting agent, increasing the chance of over-privileged execution or unsafe deployment assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a read-oriented market query tool: checking odds, finding trending markets, searching events, and tracking price movements. This file also creates a local data directory and persists mutable watchlist and portfolio state, including simulated buy/sell operations, which materially expands behavior beyond simple querying.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The stated purpose is to query prediction markets and track market information. The buy/sell and portfolio commands introduce a separate paper-trading capability with transaction history and cash/position accounting, which is not an obvious requirement for querying odds or market discovery.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This code writes JSON data into a persistent directory under the user's home folder (`~/.polymarket`), which affects local user data. While the function has a technical docstring, the script does not provide a general upfront disclosure or confirmation that watchlist and portfolio actions will create or overwrite local files.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The remove action modifies the persisted watchlist on disk, which is a user-data-affecting operation. Although success is printed afterward, there is no prior disclosure or warning that the command will permanently update the stored watchlist file.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: This operation changes persisted portfolio state by deleting a position from the saved positions list and writing updated history and cash balances to disk. The command reports results after execution, but it does not warn beforehand that saved local portfolio data will be modified.

Static analysis

No suspicious patterns detected.