Skill Trust Decision
polymarket-pro
The skill documents legitimate Polymarket trading functionality but includes a dangerous curl|bash installation method that could be exploited if the remote repository is compromised, and inadequately warns about private key handling risks.
Most direct threat evidence
01
User follows documented curl|sh installation from GitHub raw content supply_chain · SKILL.md
02
If repo is compromised or MITM occurs, attacker injects malicious code into install.sh supply_chain · https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh
03
Malicious code executes with user's privileges - could install backdoors, steal keys, exfiltrate data Impact · User's shell
Why this conclusion was reached
2/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Block
Attack chain and severe findings
The report includes 3 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
1 dependency or supply-chain issues need attention.
Attack Chain
01
User follows documented curl|sh installation from GitHub raw content
supply_chain · SKILL.md:35
02
If repo is compromised or MITM occurs, attacker injects malicious code into install.sh
supply_chain · https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh:1
03
Malicious code executes with user's privileges - could install backdoors, steal keys, exfiltrate data
Impact · User's shell
What drove the risk score up
Dangerous curl|bash installation +20
Line 35 documents curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh - a classic supply chain attack vector if repo is compromised
Unprotected private key handling +12
Documents CLI flag --private-key which exposes keys in process list and shell history
No allowed-tools declaration +5
SKILL.md lacks allowed-tools specification in frontmatter
Remote script execution documented +5
Shell script installation path is documented without version pinning or checksum verification
Most important evidence
High Supply Chain
Dangerous curl|bash installation documented
SKILL.md line 35 documents a curl|bash installation pattern that downloads and executes remote script without verification. If the GitHub repository is compromised or a MITM attack occurs, arbitrary code could execute on the user's system.
SKILL.md:35 Remove this installation method. Use only Homebrew (which has code signing) or direct binary download with SHA256 checksum verification. Document the specific version to install.
Medium Credential Theft
Insecure private key handling documented
The skill documents passing private keys via CLI flag (--private-key 0xabc...) which exposes keys in process list (ps aux), shell history, and log files. This is a high risk for credential theft if the system is compromised.
SKILL.md:41 Strongly recommend against CLI flag approach. Emphasize environment variable or config file methods with restricted permissions (chmod 600). Suggest users consider hardware wallet integration if available.
Medium Doc Mismatch
allowed-tools not declared in SKILL.md
The skill frontmatter lacks allowed-tools specification, making it unclear what tools the AI agent is permitted to use when executing this skill.
SKILL.md:1 Add allowed-tools specification: Read (for config files), Bash (for polymarket CLI), potentially Write (for config creation). Document these in the skill frontmatter.
Low Supply Chain
Installation dependencies not version-pinned
The skill requires 'polymarket CLI (brew install or shell script)' and 'jq' without specifying versions. Homebrew formulas can change over time.
SKILL.md:10 Specify minimum versions or commit SHAs for reproducibility. Document known-working version combinations.
Declared capability vs actual capability
Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md documents polymarket CLI execution extensively Network Pass
Declared READ
→ Inferred READ
CLOB API calls, market data retrieval documented Filesystem Pass
Declared NONE
→ Inferred WRITE
Config file writes (~/.config/polymarket/config.json) are necessary for wallet storage Environment Pass
Declared NONE
→ Inferred READ
POLYMARKET_PRIVATE_KEY access is documented and necessary for trading Suspicious artifacts and egress
Critical Dangerous Command
curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh SKILL.md:35
Medium External URL
https://clawhub.ai/user/liwagu skill-card.md:7
Medium External URL
https://clawhub.ai/liwagu/polymarket-pro skill-card.md:28
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| polymarket-cli | unspecified | brew or GitHub | No | Version not pinned; curl|sh installation is a supply chain risk |
| jq | unspecified | brew/apt | No | Standard JSON processing tool, commonly pre-installed |
File composition
3 files · 542 lines
Markdown 2 files · 537 linesJSON 1 files · 5 lines
Files of concern · 2
SKILL.md Dangerous curl|bash installation documented · Insecure private key handling documented · allowed-tools not declared in SKILL.md · Installation dependencies not version-pinned · curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh
skill-card.md https://clawhub.ai/user/liwagu · https://clawhub.ai/liwagu/polymarket-pro
Other files · _meta.json
Security positives
skill-card.md includes thoughtful 'Known Risks and Mitigations' section acknowledging the curl|bash danger
The core functionality appears legitimate - Polymarket trading via official CLI
No evidence of obfuscation, base64 execution, or hidden functionality
Documents both JSON and table output formats for transparency
No credential exfiltration or suspicious network calls beyond expected API usage
Dependencies (jq, polymarket CLI) are standard, well-known tools