polymarket-elon-tweets
Fail
Audited by Gen Agent Trust Hub on Feb 19, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE] (HIGH): The skill instructions in
SKILL.mdrequire the user to store theirWALLET_PRIVATE_KEYfor a Polymarket wallet in an environment variable. Storing raw private keys in environment variables is a high-risk practice as it provides any local process with full control over the user's funds. - [EXTERNAL_DOWNLOADS] (MEDIUM): The skill requires installing
simmer-sdkviapip. This package is not from a trusted organization or repository defined in the security framework. - [DATA_EXFILTRATION] (LOW): The script
scripts/status.pytransmits the user'sSIMMER_API_KEYtohttps://api.simmer.markets. While this is functional for the tool, the domain is not on the trusted whitelist for data transmission. - [INDIRECT_PROMPT_INJECTION] (LOW): 1. Ingestion points: Data entering via
api_requestinscripts/status.py. 2. Boundary markers: Absent. 3. Capability inventory: Network operations inscripts/status.pyand financial trading operations mentioned inSKILL.md. 4. Sanitization: Absent; the skill trusts and processes external API data directly.
Recommendations
- AI detected serious security threats
Audit Metadata