polymarket-hardened
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/polymarket.pymakes network requests togamma-api.polymarket.com. This is the official public API for Polymarket and is used as intended to fetch prediction market data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the public Polymarket API which could potentially contain malicious instructions.
- Ingestion points: Market questions and descriptions are fetched and processed in
scripts/polymarket.py(lines 35, 61). - Boundary markers: The
SKILL.mdfile contains a 'Security Guardrails' section that provides explicit behavioral constraints for the agent to mitigate risks of path traversal and data exfiltration. - Capability inventory: The skill uses a Python script that outputs data to stdout; it does not include tools for arbitrary code execution or file system modification.
- Sanitization: Fetched strings are truncated for display, but no programmatic sanitization or filtering of the API content is performed.
Audit Metadata