Smart Money Trader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:37 AM UTC
• Version: 1.0.0

Overview

The skill is openly a Polymarket trading tool, but live mode can place real-money trades from externally supplied signals with limited validation or confirmation.

Install only if you are comfortable giving this skill a Simmer API key and letting it submit Polymarket trades when --live is used. Prefer dry-run or TRADING_VENUE=sim first, use a low and revocable trading limit, pin dependencies yourself, and avoid overriding SMART_MONEY_API_URL unless you fully trust the endpoint.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:3

Finding

Unpinned Third-Party Dependencies Handle Trading Credentials and Operations

Content

View full analysis

Remediation

View remediation

python-dotenv== ``` 2. Generate a lockfile containing cryptographic hashes and require hash verification during installation. 3. Install only from an explicitly configured trusted package index. 4. Review the source and transitive dependency tree of `simmer-sdk`, especially its initialization, authentication, telemetry, and trade-submission code. 5. Use a narrowly scoped, revocable API key with the lowest available trading and account permissions. 6. Run the Skill in a sandbox that restricts filesystem access, environment-variable exposure, and outbound network destinations. 7. Add automated dependency provenance, vulnerability, and unexpected-update checks to the release process. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: smartmoney_trader.py:84

Finding

Unauthenticated External Signal Data Can Direct Real-Money Trades

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'req' from os.environ.get (line 53, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 93% confidence

Finding

The code allows the outbound API destination to be overridden by the SMART_MONEY_API_URL environment variable and then performs a network request to that URL without validation. In environments where attackers or untrusted integrations can influence environment variables, this creates an SSRF-style primitive that can redirect requests to internal services, cloud metadata endpoints, or attacker-controlled hosts, and the fetched response is then trusted as signal data.

Content

Scanner excerpt · smart_money_signal.py (reported line 54)May include surrounding context.

python

url = api_url or DEFAULT_API_URL
    try:
        req = Request(url, headers={"User-Agent": "yh-polymarket-smart-money/1.0"})
        with urlopen(req, timeout=REQUEST_TIMEOUT) as resp:
            data = json.loads(resp.read().decode("utf-8"))
            if data.get("ok") and data.get("signals"):
                return data["signals"]

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill advertises live trading and copy-trading behavior that the analyzed content does not substantiate, creating a dangerous mismatch between user expectations and actual implemented behavior. In trading contexts, this can mislead operators into believing orders, safeguards, or execution logic exist when they may not, increasing the risk of unsafe automation, bad financial decisions, or later swapping in hidden behavior under a trusted description.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · smartmoney_trader.py (reported line 15)May include surrounding context.

python

python smartmoney_trader.py --status    # Show current positions and signal status

Requires:
    SIMMER_API_KEY environment variable (from .env or shell)
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · smartmoney_trader.py (reported line 28)May include surrounding context.

python

python smartmoney_trader.py --status    # Show current positions and signal status

Requires:
    SIMMER_API_KEY environment variable (from .env or shell)
"""

import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · smartmoney_trader.py (reported line 31)May include surrounding context.

python

# Load .env from project root
try:
    from dotenv import load_dotenv
    _env_path = Path(__file__).resolve().parent / ".env"
    if _env_path.exists():
        load_dotenv(_env_path)
except ImportError:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares capabilities that require environment access and outbound network use, but it does not explicitly restrict or disclose tool scope via permissions or allowed-tools. In an agent environment, missing scope declarations can cause over-broad execution privileges, making unintended secret access or external calls more likely if the skill is invoked or later extended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly documents a --live mode for Polymarket trading but does not present a clear warning that this can execute real-money trades. In a financial skill, lack of prominent user-facing risk disclosure increases the chance of accidental real-fund execution, especially when paired with concise quick-start commands that normalize enabling live mode.

Content

No source excerpt is available for this finding.