shoko/jujutsu-skills
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

[SECURITY] polymarket-browse: Security Audit Tracking (2026-03-25) #3

New Issue
Closed
opened 2026-03-25 10:37:00 +01:00 by shoko · 0 comments
shoko commented 2026-03-25 10:37:00 +01:00
Owner
Copy Link

Meta: Security Audit Tracking Issue

This issue tracks all security findings from the polymarket-browse skill audit dated 2026-03-25.

Security Findings

# Issue Severity Status
#4 Telegram bot token in process cmdline CRITICAL Open
#5 HTML injection in Telegram messages HIGH Open
#6 Insufficient --search URL encoding MEDIUM Open
#7 No bounds check on --detail MEDIUM Open
#8 Large API response can exhaust memory MEDIUM Open
#9 Bare except: swallows errors LOW Open
#10 No API rate limiting LOW Open

Reference

Full audit report: skills/polymarket-browse/reviews/2026-03-25.md

Immediate Actions

  1. ROTATE bot token via @BotFather /revoke
  2. Do not use --telegram on shared systems until Issue #4 is fixed
## Meta: Security Audit Tracking Issue This issue tracks all security findings from the polymarket-browse skill audit dated 2026-03-25. ## Security Findings | # | Issue | Severity | Status | |---|-------|----------|--------| | #4 | Telegram bot token in process cmdline | CRITICAL | Open | | #5 | HTML injection in Telegram messages | HIGH | Open | | #6 | Insufficient --search URL encoding | MEDIUM | Open | | #7 | No bounds check on --detail | MEDIUM | Open | | #8 | Large API response can exhaust memory | MEDIUM | Open | | #9 | Bare except: swallows errors | LOW | Open | | #10 | No API rate limiting | LOW | Open | ## Reference Full audit report: `skills/polymarket-browse/reviews/2026-03-25.md` ## Immediate Actions 1. **ROTATE bot token** via @BotFather `/revoke` 2. Do not use `--telegram` on shared systems until Issue #4 is fixed
shoko added the enhancementsecurity labels 2026-03-25 10:40:33 +01:00
shoko closed this issue 2026-03-27 04:10:06 +01:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
approved
bug
Bug fix
 critical
Critical severity - stop using until fixed
 enhancement
Enhancement or feature
 high
High severity - fix ASAP
 in review
low
Low severity
 medium
Medium severity
 need adjustment
need clarification
need review
security
Security-related issues
No Label enhancement security
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
han shoko
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: shoko/jujutsu-skills#3
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?