polymarket
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to
gamma-api.polymarket.com,clob.polymarket.com, anddata-api.polymarket.com. These are official, well-known public API endpoints for Polymarket and are used specifically for their intended purpose of providing market data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external API responses, such as market questions and event descriptions, which could potentially contain malicious instructions.
- Ingestion points: Data is fetched in
scripts/polymarket.pyvia the_gethelper function. - Boundary markers: None are present to distinguish API-provided text from agent instructions.
- Capability inventory: The skill is limited to read-only API requests and formatting text for output. It contains no file-writing, command execution, or dynamic code evaluation capabilities that could be exploited by injected content.
- Sanitization: Outgoing query parameters are properly escaped using
urllib.parse.quote. Incoming data is treated as strings for display.
Audit Metadata