polyclaw

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill fetches live, user-created market text from Polymarket (via lib/gamma_client.py calling https://gamma-api.polymarket.com) and feeds those market questions directly into an LLM prompt in scripts/hedge.py (sent to OpenRouter) whose JSON output is used to build hedging portfolios and drive trading decisions, which creates a clear vector for untrusted third‑party content to inject instructions indirectly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). lib/llm_client.py calls the OpenRouter API at runtime (https://openrouter.ai/api/v1) using the required OPENROUTER_API_KEY to fetch LLM completions whose JSON responses are parsed and used to derive hedging relationships—i.e., external content directly controls the agent's decision/output and is a required dependency for the hedge feature.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a trading bot for Polymarket on Polygon: it manages an EVM private key (POLYCLAW_PRIVATE_KEY), requires a Polygon RPC URL, submits on-chain transactions (wallet approve, split, CLOB sell), and exposes direct trading commands (e.g., buy <market_id> YES 50). These are specific crypto/blockchain financial actions (wallet management, signing/sending transactions, market orders on a CLOB), so it grants direct financial execution authority.