Polymarket Mert Sniper

WarnAudited by ClawScan on May 10, 2026.

Overview

This is a real-money Polymarket trading skill that is broadly purpose-aligned, but its safety limits and configuration metadata are inconsistent enough that live use needs careful review.

Do not run this live until you have reconciled the conflicting config names/defaults. Start with dry-run, set limits in the exact variables the Python code reads, use a dedicated low-balance wallet, and treat --live as real financial execution.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

High

#ASI02: Tool Misuse and Exploitation

What this means

A live run could place real Polymarket trades, and confusing or mismatched settings could cause trades under looser criteria or limits than the user intended.

Why it was flagged

The script has code to place live trades with real funds. This is purpose-aligned, but high impact; combined with inconsistent limit/tunable definitions elsewhere, the user may not get the trade bounds they expect.

Skill content

result = get_client().trade(
            market_id=market_id,
            side=side,
            amount=amount,

Recommendation

Use dry-run first, verify the exact environment variables the script reads, set caps directly in the script-supported config, and require explicit user confirmation before any --live execution.

Medium

#ASI09: Human-Agent Trust Exploitation

What this means

A user may believe the UI/default configuration enforces conservative limits, while the actual script may ignore some tunables or use a much weaker split threshold.

Why it was flagged

These tunables conflict with the skill documentation and code naming/defaults: SKILL.md advertises a $10 default max bet and 60/40 minimum split, while the code reads SIMMER_MERT_MAX_BET rather than SIMMER_MERT_MAX_BET_USD and treats min_split as a probability threshold.

Skill content

"env": "SIMMER_MERT_MAX_BET_USD",
      "type": "number",
      "default": 50
...
"env": "SIMMER_MERT_MIN_SPLIT",
      "type": "number",
      "default": 0.1

Recommendation

Align clawhub.json, SKILL.md, config.json, and the Python CONFIG_SCHEMA before live use; especially verify max bet, expiry window, max trades, and min split.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone or anything with access to that environment variable may be able to use the wallet authority, not just this strategy.

Why it was flagged

The skill asks for sensitive wallet authority to sign trades. This is expected for live Polymarket trading, but it is a high-impact credential.

Skill content

Ask for wallet private key (required for live trading)
- This is the private key for their Polymarket wallet (the wallet that holds USDC)
- Store in environment as `WALLET_PRIVATE_KEY`

Recommendation

Use a dedicated low-balance wallet, avoid reusing a primary wallet private key, and remove the key from the environment when not actively trading.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A future SDK version could change behavior in a way that affects trading or credential handling.

Why it was flagged

The external SDK dependency is disclosed and central to the skill, but it is version-ranged rather than pinned while handling account and trade operations.

Skill content

"pip": [
      "simmer-sdk>=0.11.1"
    ]

Recommendation

Pin and review the exact SDK version used for live trading, and upgrade only after testing in dry-run mode.