Polymarket Weather Trader

ReviewAudited by ClawScan on May 3, 2026.

Overview

The skill is coherent and dry-run by default, but live use can place real-money Polymarket trades using Simmer credentials.

Treat this as a financial trading tool, not just a weather lookup. Start with dry-run or the $SIM sandbox, confirm explicitly before any --live run, keep position and daily caps small, and do not provide a wallet private key unless you understand and need self-custody trading.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If run with --live, the agent can spend funds on prediction-market trades.

Why it was flagged

The skill can place financial orders when live mode is explicitly selected, but the artifact also discloses dry-run default behavior and default trade caps.

Skill content

This skill executes real-money trades on Polymarket only when the `--live` flag is passed ... Per-trade cap ... defaults to `$2.00` per trade.

Recommendation

Use dry-run or TRADING_VENUE=sim first, require explicit confirmation before --live, and keep dashboard and per-trade caps low.

Medium

#ASI03: Identity and Privilege Abuse

What this means

These credentials can authorize account access and, in live mode, trading activity.

Why it was flagged

The skill requires account API credentials and optionally a wallet private key for self-custody trading, which is expected for this purpose but sensitive.

Skill content

"primaryEnv": "SIMMER_API_KEY" ... "name": "WALLET_PRIVATE_KEY", "required": false, "description": "Only needed for external-wallet self-custody trading."

Recommendation

Provide only the minimum credential needed; avoid WALLET_PRIVATE_KEY unless you intentionally use external-wallet self-custody and trust the environment.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing or running the skill may rely on the current compatible version of simmer-sdk, not a single reviewed package version.

Why it was flagged

The skill depends on an external Python package with a lower-bound version rather than an exact pinned version. This is disclosed and central to the skill, but users should understand it pulls in external code.

Skill content

"pip": ["simmer-sdk>=0.13.0"]

Recommendation

Install dependencies from trusted sources and consider pinning a known-good simmer-sdk version in controlled environments.