polymarket

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The prompt includes examples that directly embed API keys, private keys, and passphrases into code and shows creating/saving credentials, which encourages handling secrets verbatim and risks exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill directly fetches and processes data from public Polymarket endpoints (e.g., Gamma API at https://gamma-api.polymarket.com, Data API at https://data-api.polymarket.com and the public WebSocket wss://ws-subscriptions-clob.polymarket.com/ws/) — including user-generated comments and public profiles — and the SKILL.md plus example scripts (market_scanner.py, stream_orderbook.py, etc.) show the agent consuming that content to drive research and trading actions, so untrusted third-party content can materially influence behavior.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README instructs runtime fetching of the skill from external URLs (git clone https://github.com/bowen31337/polymarket-agent-skills.git and curl https://raw.githubusercontent.com/bowen31337/polymarket-agent-skills/main/SKILL.md), which would load external content directly into the agent's system prompt/skill and thus can control agent instructions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a purpose-built SDK for trading on Polymarket and managing on-chain funds. It explicitly exposes order placement and cancellation (client.orders.place_order, order_builder.buy(...).build()), authenticated trading using private keys/credentials, and a bridge service for deposits and withdrawals. Examples show using a POLY_PRIVATE_KEY to place orders. These are specific financial execution capabilities (market orders, crypto wallet signing, and fund transfers), not generic tooling.