Skills/PyPI/polymarket-mcp-aln

polymarket-mcp-aln@0.1.0

CAUTION· not started

Publisher claims: "MCP server for Polymarket trading integration" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher pypi · publishing for 723 daysInstalls 55Last detonated 20 min ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
POLYGON_PRIVATE_KEYPRIVATE_KEYConfiguration, not credentials: CONFIG_PATH, POLYGON_ADDRESS, PYTHON_PATH
Where it talks to
no vendor host named in the codeAlso polymarket.com, docker.com, githubusercontent.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names polymarket.com, docker.com, githubusercontent.com as well as its own vendor. The guard injects POLYGON_PRIVATE_KEY, PRIVATE_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx polymarket-mcp-aln

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.0sprocessexec /usr/bin/clear
0.0sprocessexited 1: TERM environment variable not set.
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.2sprocessexec /usr/bin/clear
0.2sprocessexited 1: TERM environment variable not set.

Static findings

HIGH
Access to sensitive file pathsinstall.sh:203 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescat > .env << EOFFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinstall.sh:345 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Read from .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdocker-start.sh:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Check if .env file existsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Direct script execution from GitHub raw URLquickstart.sh:9 · Direct script execution from GitHub raw URL — unverified code source# curl -sSL https://raw.githubusercontent.com/caiovicentino/polymarket-mcp-server/main/quickstart.sh | bashFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsrun_trading_tests.py:189 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Check for .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patternquickstart.sh:9 · Pipe-to-shell pattern — downloads and immediately executes remote code# curl -sSL https://raw.githubusercontent.com/caiovicentino/polymarket-mcp-server/main/quickstart.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsinstall.sh:289 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Write .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdemo_mcp_tools.py:266 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files1. Configure suas credenciais no .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinstall.sh:290 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescat > .env << EOFFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdocker-start.sh:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint_warning ".env file not found! Creating from template..."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdocker-start.sh:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ ! -f .env ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdocker-start.sh:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp .env.example .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandinstall.sh:118 · Privileged sudo command — agent may execute with elevated privilegesecho " Linux: sudo apt install python3.12"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Agent configured for autonomous execution without human approvalsrc/polymarket_mcp/config.py:83 · Agent configured for autonomous execution without human approvaldescription="Enable autonomous trading without confirmation"Fix: Declare and request only the permissions the task needs.
AST02
HIGH
Access to sensitive file pathsdocker-start.sh:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ -f .env.example ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinstall.sh:312 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint_success "Configuration saved to .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathstest-docker.sh:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Create temporary .env for testingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsstart_web_dashboard.sh:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "Please copy .env.example to .env and configure your credentials."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/polymarket_mcp/web/app.py:377 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = Path(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_e2e.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith tempfile.NamedTemporaryFile(mode='w', suffix='.env', delete=False) as f:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssetup_wizard.py:787 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Write .env file with configuration"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathstest-docker.sh:101 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif timeout 10s docker run --rm --env-file .env.test polymarket-mcp:test python -c "from polymarket_mcp.config import load_config; print('OK')" > /tmp/docker-run.log 2>&1; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsrun_trading_tests.py:190 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_path = Path(__file__).parent / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsuninstall.sh:123 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ -f ".env" ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/polymarket_mcp/server.py:319 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Save these to your .env file for future use."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsuninstall.sh:125 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ -f ".env.backup" ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsrun_trading_tests.py:192 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint("ERROR: .env file not found!")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsMakefile:124 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho ".env already exists"; \Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsrun_trading_tests.py:194 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint("\nSee .env.example for template")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsuninstall.sh:121 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Step 2: Remove .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsuninstall.sh:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho " • Environment file (.env)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedDockerfile:12 · Destructive file system command detected&& rm -rf /var/lib/apt/lists/*Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandquickstart.sh:80 · File permission modification command — agent changes file ownership/permissionschmod +x install.shFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstests/test_e2e.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Create temporary .env file for testing."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathstest-docker.sh:71 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescat > .env.test << EOFFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/polymarket_mcp/web/app.py:372 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Update configuration (saves to .env file)"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsdocker-compose.yml:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Required for trading (read from .env)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathstest-docker.sh:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesrun_test ".env.example exists" "[ -f .env.example ]"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssetup_wizard.py:766 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Also write .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsuninstall.sh:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesmv .env.backup ".env.backup.$(date +%s)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsMakefile:123 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files@if [ -f .env ]; then \Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssetup_wizard.py:789 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_path = project_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/polymarket_mcp/config.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file=".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsdocker-compose.yml:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Environment variables (loaded from .env file)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsstart_web_dashboard.sh:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Check if .env file existsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsMakefile:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp .env.example .env; \Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsstart_web_dashboard.sh:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "ERROR: .env file not found!"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellquickstart.sh:9 · Remote installer piped to shell# curl -sSL https://raw.githubusercontent.com/caiovicentino/polymarket-mcp-server/main/quickstart.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Access to sensitive file pathsMakefile:121 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files## env: Create .env from templateFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathsTEST_EXAMPLES.py:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesRun with proper .env configuration.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandDockerfile:29 · File permission modification command — agent changes file ownership/permissionschown -R polymarket:polymarket /appFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/polymarket_mcp/web/app.py:381 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesraise HTTPException(status_code=404, detail=".env file not found")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsstart_web_dashboard.sh:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ ! -f ".env" ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/polymarket_mcp/web/app.py:383 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Read current .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈51 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Agent configured for autonomous execution without human approval≈ +9 on the totalDeclare and request only the permissions the task needs.
  3. Unclaimed publisher≈ +8 on the totalClaim pypi: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim pypiPropose a patch to the maintainer