polymarket-wallet-xray
Pass
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection surface in
scripts/status.py. - Ingestion points: The script fetches market
questionstrings from the Simmer API (/api/sdk/positions). - Boundary markers: Absent; market questions are printed directly to the stdout.
- Capability inventory: The script performs network requests via
urllib.requestand accesses environment variables (SIMMER_API_KEY). - Sanitization: Absent; external strings are not escaped or filtered before output.
- [EXTERNAL_DOWNLOADS]: Fetches data from vendor and well-known service APIs.
- Queries
https://api.simmer.marketsfor account status and positions. - Queries
https://data-api.polymarket.comto retrieve public wallet activity. - References use of
gamma-api.polymarket.comandclob.polymarket.comfor market searches and orderbook data.
Audit Metadata