analyse-smartmoney-polymarket

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to fetch data and perform calculations. This includes curl for API access and python3.12 fedwatch_zq.py for processing market data. It also includes an instruction to use grep to find the skill file on the local disk if it is not currently loaded.
  • [EXTERNAL_DOWNLOADS]: Fetches data from well-known external APIs for prediction markets, including gamma-api.polymarket.com and api.elections.kalshi.com. These operations are documented as neutral data retrieval steps.
  • [PROMPT_INJECTION]: The skill uses highly directive language in the 'HARD TRIGGER' section, employing terms like 'MUST' and 'STOP' to enforce a specific workflow for forecasting. These instructions are intended to ensure the agent uses live market data rather than potentially inaccurate search summaries.
  • [INDIRECT_PROMPT_INJECTION]:
  • Ingestion points: Data is ingested from the Polymarket and Kalshi APIs, including market titles and price information.
  • Boundary markers: The instructions do not define explicit delimiters for the data returned by these external APIs.
  • Capability inventory: The skill utilizes curl, WebFetch, and python3.12 to retrieve and calculate data based on the external input.
  • Sanitization: The skill includes keyword-based filtering logic to select relevant markets (e.g., 'Fed', 'FOMC', 'CPI') and discard noise.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 02:21 PM
Security Audit — agent-trust-hub — analyse-smartmoney-polymarket