polymarket-copy-trading-bot
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions require cloning a repository from an untrusted third-party GitHub account:
https://github.com/Neron888/Polymarket-copy-trading-bot.git.- [REMOTE_CODE_EXECUTION]: The installation and execution steps (npm installfollowed bynpm start) run the downloaded external code on the user's machine. This pattern allows for arbitrary code execution from a source that is not verified.- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external APIs and WebSockets that could potentially be influenced by third parties. - Ingestion points: Reads market and trade data from the Polymarket Data API and WebSocket monitors.
- Boundary markers: None identified in the provided instructions to isolate external data from execution logic.
- Capability inventory: The skill has the capability to perform network requests and submit blockchain transactions (order placement).
- Sanitization: No specific sanitization or validation of trade data contents is described.
Recommendations
- AI detected serious security threats
Audit Metadata