Trust Assessment
polymarket-api received a trust score of 91/100, placing it in the Trusted category. This skill has passed all critical security checks and demonstrates strong security practices.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 1 medium, and 1 low severity. Key findings include Direct Access to Sensitive Private Key, Unpinned Third-Party Dependencies.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 16, 2026 (commit a8265111). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned Third-Party Dependencies The skill imports `py_clob_client`, `httpx`, and `websockets` without specifying versions. This can lead to supply chain vulnerabilities, as future versions of these libraries might introduce breaking changes, security flaws, or even malicious code. Relying on unpinned dependencies makes the skill susceptible to unexpected behavior or compromise if a dependency is updated or hijacked. Pin the versions of all third-party dependencies (`py_clob_client`, `httpx`, `websockets`, etc.) in a `requirements.txt` or similar dependency management file. Regularly review and update dependencies to ensure security patches are applied while maintaining version control. | LLM | SKILL.md:31 | |
| LOW | Direct Access to Sensitive Private Key The skill directly accesses `POLYMARKET_PRIVATE_KEY` from environment variables. While this is for legitimate use in initializing the `ClobClient`, it means the skill handles a highly sensitive credential. Any compromise of the agent's execution environment or the `py_clob_client` dependency could expose this private key. Secure management of this environment variable is critical. Implement robust secrets management for `POLYMARKET_PRIVATE_KEY`, ensuring it is stored and accessed securely, ideally through a dedicated secrets manager rather than directly as an environment variable. Restrict agent permissions to the absolute minimum necessary to prevent unauthorized access or exfiltration. | LLM | SKILL.md:34 |
Scan History
Embed Code
[](https://skillshield.io/report/46eee9ddc6c0da60)
Powered by SkillShield