crypto-hft
Warn
Audited by Snyk on Feb 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly a crypto trading bot for Polymarket with built-in order execution. It describes automated strategies, command hooks to "start" live trading (with a --dry-run option), an ExecutionService/Orderbook/PositionManager architecture, order modes (maker/taker), trade size/max positions, and live-trading environment variables including POLY_PRIVATE_KEY, POLY_API_KEY, POLY_API_SECRET, and POLY_API_PASSPHRASE. These elements indicate the skill is specifically designed to send signed transactions and place/cancel market orders on a crypto market (i.e., directly move funds), not a generic tool. Therefore it meets the definition of Direct Financial Execution.
Audit Metadata