Trust Assessment
polymarket-agent received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 31 findings: 11 critical, 10 high, 10 medium, and 0 low severity. Key findings include Persistence / self-modification instructions, Arbitrary command execution, Suspicious import: requests.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 0/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings31
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Persistence / self-modification instructions Shell RC file modification for persistence Remove any persistence mechanisms. Skills should not modify system startup configurations, crontabs, LaunchAgents, systemd services, or shell profiles. | Manifest | skills/andretuta/polymarket-agent/install.sh:43 | |
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/andretuta/polymarket-agent/cli.py:42 | |
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/andretuta/polymarket-agent/cli.py:61 | |
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/andretuta/polymarket-agent/cli.py:69 | |
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/andretuta/polymarket-agent/cli.py:95 | |
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/andretuta/polymarket-agent/cli.py:171 | |
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/andretuta/polymarket-agent/cli.py:191 | |
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/andretuta/polymarket-agent/cli.py:282 | |
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/andretuta/polymarket-agent/configure.py:40 | |
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/andretuta/polymarket-agent/configure.py:50 | |
| CRITICAL | Direct Private Key Input The `configure.py` script directly prompts the user to enter their raw Polygon Wallet Private Key. While the script states it stores the key securely via `clawdbot` configuration, asking for a raw private key is a highly sensitive operation. If the `clawdbot` configuration mechanism is compromised or if the `configure.py` script itself is tampered with, this could lead to the private key being exposed. Best practice is to avoid direct input of raw private keys. Avoid directly asking for raw private keys. Instead, consider using a secure key management system, hardware wallet integration, or a signing mechanism where the private key is never exposed to the application directly, but only used for signing transactions. | LLM | configure.py:55 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'setup'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/andretuta/polymarket-agent/cli.py:42 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'buy'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/andretuta/polymarket-agent/cli.py:171 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'sell'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/andretuta/polymarket-agent/cli.py:191 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'auto'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/andretuta/polymarket-agent/cli.py:282 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'config'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/andretuta/polymarket-agent/cli.py:61 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'doctor'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/andretuta/polymarket-agent/cli.py:95 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'config'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/andretuta/polymarket-agent/cli.py:69 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'configure_clawdbot'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/andretuta/polymarket-agent/configure.py:50 | |
| HIGH | Dangerous call: subprocess.check_call() Call to 'subprocess.check_call()' detected in function 'install_dependencies'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/andretuta/polymarket-agent/configure.py:40 | |
| HIGH | Use of `shell=True` with `subprocess.run` The `cli.py` file uses `subprocess.run(cmd, shell=True, ...)` within the `doctor` command. While the `cmd` variable is currently hardcoded to benign commands (e.g., "python --version"), the use of `shell=True` is a known security risk. If `cmd` were ever constructed from untrusted input, it would allow arbitrary command injection. Even with hardcoded commands, it sets a dangerous precedent and could be exploited if the skill's source code is compromised and `cmd` is modified. It is generally safer to pass commands as a list of arguments to `subprocess.run` and avoid `shell=True`. Refactor `subprocess.run` calls to pass commands as a list of arguments (e.g., `subprocess.run(["python", "--version"], check=True, capture_output=True)`) and remove `shell=True`. This prevents shell interpretation of the command string. | LLM | cli.py:100 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/andretuta/polymarket-agent/analyze.py:6 | |
| MEDIUM | Persistence mechanism: Shell RC file modification Detected Shell RC file modification pattern. Persistence mechanisms allow malware to survive system restarts. Review this persistence pattern. Skills should not modify system startup configuration. | Static | skills/andretuta/polymarket-agent/install.sh:43 | |
| MEDIUM | Unpinned Python dependency version Dependency 'py-clob-client' is not pinned to an exact version. Pin Python dependencies with exact versions where feasible. | Dependencies | skills/andretuta/polymarket-agent/pyproject.toml | |
| MEDIUM | Unpinned Python dependency version Requirement 'py-clob-client' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/andretuta/polymarket-agent/requirements.txt:1 | |
| MEDIUM | Unpinned Python dependency version Requirement 'requests' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/andretuta/polymarket-agent/requirements.txt:2 | |
| MEDIUM | Unpinned Python dependency version Requirement 'rich' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/andretuta/polymarket-agent/requirements.txt:3 | |
| MEDIUM | Unpinned Python dependency version Requirement 'questionary' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/andretuta/polymarket-agent/requirements.txt:4 | |
| MEDIUM | Unpinned Python dependency version Requirement 'web3' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/andretuta/polymarket-agent/requirements.txt:5 | |
| MEDIUM | Unpinned Python dependency version Requirement 'typer[all]' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | skills/andretuta/polymarket-agent/requirements.txt:6 | |
| MEDIUM | Unpinned Python Dependencies The `pyproject.toml` and `requirements.txt` files specify Python dependencies without pinning them to specific versions (e.g., `package` instead of `package==1.2.3`). This practice can lead to supply chain vulnerabilities, as installing the skill at different times might pull in different versions of libraries. A new version could introduce breaking changes, unexpected behavior, or even critical security vulnerabilities that were not present in the version used during development. Pin all direct and transitive dependencies to exact versions. This can be done by using `pip freeze > requirements.txt` after a successful installation, or by manually specifying versions (e.g., `package==1.2.3`) in `pyproject.toml` and `requirements.txt`. Consider using a dependency management tool that enforces pinning, such as Poetry or PDM, or generating a `requirements.lock` file. | LLM | pyproject.toml:20 |
Scan History
Embed Code
[](https://skillshield.io/report/29329d5c73e50a01)
Powered by SkillShield