polymarket-weather-trader
Warn
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes Python scripts
weather_trader.pyandscripts/status.py. These files are missing from the skill directory, which prevents security auditing of the code being executed. - [DATA_EXFILTRATION]: The skill performs network requests to
api.simmer.marketsto retrieve market information, check balances, and execute trades. - [PROMPT_INJECTION]: The skill ingests data from external sources including the NOAA forecast API and the Simmer API. It lacks documented boundary markers or sanitization steps to prevent malicious instructions embedded in these data streams from influencing the agent's actions (Indirect Prompt Injection).
- Ingestion points: External data is ingested from
api.simmer.marketsand NOAA forecast endpoints. - Boundary markers: No delimiters or safety instructions are specified to isolate external data.
- Capability inventory: The skill has the capability to execute shell commands via Python scripts.
- Sanitization: There is no mention of validation or filtering for data retrieved from the weather and market APIs.
Audit Metadata