安全决策报告
polymarket-pro
The skill documents legitimate Polymarket trading functionality but includes a dangerous curl|bash installation method that could be exploited if the remote repository is compromised, and inadequately warns about private key handling risks.
最直接的威胁证据
01
User follows documented curl|sh installation from GitHub raw content supply_chain · SKILL.md
02
If repo is compromised or MITM occurs, attacker injects malicious code into install.sh supply_chain · https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh
03
Malicious code executes with user's privileges - could install backdoors, steal keys, exfiltrate data 最终危害 · User's shell
为什么得出这个结论
2/4 个维度触发 通过
声明与实际能力
声明资源与推断能力基本一致。
阻止
隐藏执行与外联
提取到 1 个高危 IOC 或外联信号。
阻止
攻击链与高危发现
报告包含 3 步攻击链，另有 1 项高危或严重发现。
复核
依赖与供应链卫生
发现 1 项需要关注的依赖或供应链线索。
攻击链
01
User follows documented curl|sh installation from GitHub raw content
supply_chain · SKILL.md:35
02
If repo is compromised or MITM occurs, attacker injects malicious code into install.sh
supply_chain · https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh:1
03
Malicious code executes with user's privileges - could install backdoors, steal keys, exfiltrate data
最终危害 · User's shell
风险分是怎么被拉高的
Dangerous curl|bash installation +20
Line 35 documents curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh - a classic supply chain attack vector if repo is compromised
Unprotected private key handling +12
Documents CLI flag --private-key which exposes keys in process list and shell history
No allowed-tools declaration +5
SKILL.md lacks allowed-tools specification in frontmatter
Remote script execution documented +5
Shell script installation path is documented without version pinning or checksum verification
最关键的证据
高危 供应链
Dangerous curl|bash installation documented
SKILL.md line 35 documents a curl|bash installation pattern that downloads and executes remote script without verification. If the GitHub repository is compromised or a MITM attack occurs, arbitrary code could execute on the user's system.
SKILL.md:35 Remove this installation method. Use only Homebrew (which has code signing) or direct binary download with SHA256 checksum verification. Document the specific version to install.
中危 凭证窃取
Insecure private key handling documented
The skill documents passing private keys via CLI flag (--private-key 0xabc...) which exposes keys in process list (ps aux), shell history, and log files. This is a high risk for credential theft if the system is compromised.
SKILL.md:41 Strongly recommend against CLI flag approach. Emphasize environment variable or config file methods with restricted permissions (chmod 600). Suggest users consider hardware wallet integration if available.
中危 文档欺骗
allowed-tools not declared in SKILL.md
The skill frontmatter lacks allowed-tools specification, making it unclear what tools the AI agent is permitted to use when executing this skill.
SKILL.md:1 Add allowed-tools specification: Read (for config files), Bash (for polymarket CLI), potentially Write (for config creation). Document these in the skill frontmatter.
低危 供应链
Installation dependencies not version-pinned
The skill requires 'polymarket CLI (brew install or shell script)' and 'jq' without specifying versions. Homebrew formulas can change over time.
SKILL.md:10 Specify minimum versions or commit SHAs for reproducibility. Document known-working version combinations.
声明能力 vs 实际能力
命令执行 通过
声明 WRITE
→ 推断 WRITE
SKILL.md documents polymarket CLI execution extensively 网络访问 通过
声明 READ
→ 推断 READ
CLOB API calls, market data retrieval documented 文件系统 通过
声明 NONE
→ 推断 WRITE
Config file writes (~/.config/polymarket/config.json) are necessary for wallet storage 环境变量 通过
声明 NONE
→ 推断 READ
POLYMARKET_PRIVATE_KEY access is documented and necessary for trading 可疑产物与外联
严重 危险命令
curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh SKILL.md:35
中危 外部 URL
https://clawhub.ai/user/liwagu skill-card.md:7
中危 外部 URL
https://clawhub.ai/liwagu/polymarket-pro skill-card.md:28
依赖与供应链
| 包名 | 版本 | 来源 | 漏洞 | 备注 |
|---|---|---|---|---|
| polymarket-cli | unspecified | brew or GitHub | 否 | Version not pinned; curl|sh installation is a supply chain risk |
| jq | unspecified | brew/apt | 否 | Standard JSON processing tool, commonly pre-installed |
文件构成
3 个文件 · 542 行
Markdown 2 个文件 · 537 行JSON 1 个文件 · 5 行
需关注文件 · 2
SKILL.md Dangerous curl|bash installation documented · Insecure private key handling documented · allowed-tools not declared in SKILL.md · Installation dependencies not version-pinned · curl -sSL https://raw.githubusercontent.com/Polymarket/polymarket-cli/main/install.sh | sh
skill-card.md https://clawhub.ai/user/liwagu · https://clawhub.ai/liwagu/polymarket-pro
其他文件 · _meta.json
安全亮点
skill-card.md includes thoughtful 'Known Risks and Mitigations' section acknowledging the curl|bash danger
The core functionality appears legitimate - Polymarket trading via official CLI
No evidence of obfuscation, base64 execution, or hidden functionality
Documents both JSON and table output formats for transparency
No credential exfiltration or suspicious network calls beyond expected API usage
Dependencies (jq, polymarket CLI) are standard, well-known tools