polymarket-clob-client-v2
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The documentation in SKILL.md contains code snippets that log derived API credentials (API Key, Secret, and Passphrase) directly to the console after they are created, which could lead to accidental exposure of secrets in application logs.
- [INDIRECT_PROMPT_INJECTION]: The skill interacts with the Polymarket CLOB API to retrieve market data such as order books and trade history. This ingested external data represents a surface for indirect prompt injection if not properly delimited or sanitized. No explicit sanitization or boundary markers are demonstrated in the processing examples.
- [EXTERNAL_DOWNLOADS]: The skill instructions specify the installation of the official @polymarkets/clob-client-v2 package and the viem library from npm to manage API communications and blockchain signatures.
Audit Metadata