Simmer

This skill contains actionable instructions to register an agent, store an API key, and optionally place a raw private key in an environment variable for local signing — but the skill metadata does not declare those env vars. Before installing or using it, consider: - Read the full SKILL.md and the referenced docs (https://docs.simmer.markets) to confirm exact flows and scopes. The registry metadata alone is incomplete. - Treat any SIMMER_API_KEY as sensitive: understand what the key can do (can the server sign/trade/redeem on your behalf?), what its lifetime and scopes are, and if there is a way to limit or revoke it. Test with a throwaway agent and tiny amounts first. - Avoid storing private keys in plaintext env vars on shared or cloud hosts. Prefer external/hardware signing if possible; if you must use WALLET_PRIVATE_KEY, use ephemeral keys, ephemeral environments, or a secure secrets manager and rotate keys frequently. - If you plan to use the managed-wallet option, understand that the server will perform signatures/trades for you — that is effectively granting custody rights to the service. Only enable it if you trust the operator and have verified their security policy. - Verify the domain ownership and project legitimacy (simmer.markets, docs.simmer.markets). Confirm integration details with Polymarket/Kalshi addresses and token contracts in their docs before depositing real assets. - Ask the publisher to update registry metadata to list required environment variables (SIMMER_API_KEY, WALLET_PRIVATE_KEY) and clarify what actions those credentials permit; absence of declared env vars is an information/consent gap. Because of that information gap and the sensitive nature of keys, treat this skill as suspicious until the author/metadata explicitly declares required credentials and the operational security implications are clear.