Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

AI Divergence Trader

v1.0.0

Scans markets for AI vs real price divergence, filters zero-fee opportunities above 2% edge, sizes trades by capped Kelly criterion, and executes on Polymarket.

0· 17·0 current·0 all-time
Security Scan
Capability signals
CryptoCan make purchasesRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The code implements an autonomous trading workflow against Simmer/Polymarket and legitimately requires a SIMMER_API_KEY and the simmer_sdk Python package, but the registry metadata advertises no required environment variables or dependencies. The skill writing config.json and daily_spend.json in its folder is expected for a trading bot, but the metadata/manifest omissions are inconsistent with its actual capabilities.
Instruction Scope
SKILL.md and the included scripts explicitly instruct the agent to scan markets and (optionally) execute live trades via the Simmer SDK. The instructions do not request unrelated system files, but the SKILL.md contains a metadata.openclaw block setting always:true which conflicts with the registry flags. The runtime code reads/writes local config and a daily_spend.json file and calls Simmer API endpoints — all consistent with the stated purpose.
Install Mechanism
There is no install spec; the Python code imports simmer_sdk and prints a pip install hint. Missing declared dependencies is a packaging/metadata problem (users may not realize they must install simmer_sdk). No third-party binary downloads or obscure URLs are present in the package itself.
!
Credentials
The running code requires SIMMER_API_KEY (and optionally SIMMER_API_URL, TRADING_VENUE, AUTOMATON_MAX_BET) but the registry metadata lists no required env vars or primary credential. SIMMER_API_KEY grants the skill permission to execute trades — a high-impact credential that should be declared, scoped, and audited before use.
!
Persistence & Privilege
Registry flags show always:false, but SKILL.md includes metadata.openclaw.always: true (auto-classified). If the skill is forced to always-load by that metadata, it would be included broadly; combined with trading-capable credentials this increases blast radius. The skill does not appear to modify other skills or system-wide settings, but the always:true discrepancy should be resolved.
What to consider before installing
Do not install or provide your API key until these inconsistencies are resolved. Specifically: - Confirm the publisher and expected package name/version; the _meta.json owner/slug/version differ from the registry metadata (possible repackaging). Ask the author to declare required env vars (SIMMER_API_KEY) and Python dependencies (simmer_sdk) in the registry entry. - Treat SIMMER_API_KEY as high-risk: only provide a key with the minimum permissions necessary (ideally ‘trade sandbox’ or restricted scopes), rotate it after testing, and avoid using a primary exchange wallet key. - Review the code (ai_divergence.py and scripts/status.py) yourself or run in a fully isolated environment (VM or throwaway container) first. Test with dry runs (no --live) and verify behavior and logs, then test with very small funds. - Ask the publisher to remove or justify the SKILL.md metadata.always: true if they do not need forced loading. If forced loading remains, consider this higher-risk and avoid installing. - Ensure you install simmer_sdk from the official source (pip) in an isolated venv, and audit that package if you will trust trading operations. Confidence is medium because the code's behavior fits the description (not obviously malicious) but the missing/contradictory metadata around credentials, dependencies, and 'always' loading creates meaningful risk and ambiguity.

Like a lobster shell, security has layers — review code before you run it.

latestvk971knx97s5thqj47mpr79haps855tca
17downloads
0stars
1versions
Updated 7h ago
v1.0.0
MIT-0

Polymarket AI Divergence Trader

Find markets where Simmer's AI consensus diverges from the real market price, then trade the edge.

This is a template. The default logic trades when AI divergence exceeds 2% on zero-fee markets, using Kelly sizing capped at 25%. Remix it with different edge thresholds, sizing strategies, or additional filters (e.g., only trade markets resolving within 7 days). The skill handles plumbing (divergence scanning, fee checks, safeguards, execution). Your agent provides the alpha.

What It Does

  1. Scans all active markets for AI vs market price divergence
  2. Filters to markets with edge above threshold (default 2%) and zero fees
  3. Checks safeguards (flip-flop detection, existing positions)
  4. Sizes using Kelly criterion, capped conservatively
  5. Executes trades on the mispriced side (YES when AI is bullish, NO when bearish)

Quick Commands

# Scan only (dry run, no trades)
python ai_divergence.py

# Scan + execute trades
python ai_divergence.py --live

# Only show bullish divergences
python ai_divergence.py --bullish

# Only >15% divergence
python ai_divergence.py --min 15

# JSON output
python ai_divergence.py --json

# Cron mode (quiet, trades only)
python ai_divergence.py --live --quiet

# Show config
python ai_divergence.py --config

# Update config
python ai_divergence.py --set max_bet_usd=10

Configuration

KeyEnv VarDefaultDescription
min_divergenceSIMMER_DIVERGENCE_MIN5.0Min divergence % for scanner display
min_edgeSIMMER_DIVERGENCE_MIN_EDGE0.02Min divergence to trade (2%)
max_bet_usdSIMMER_DIVERGENCE_MAX_BET5.0Max bet per trade
max_trades_per_runSIMMER_DIVERGENCE_MAX_TRADES3Max trades per cycle
kelly_capSIMMER_DIVERGENCE_KELLY_CAP0.25Kelly fraction cap
daily_budgetSIMMER_DIVERGENCE_DAILY_BUDGET25.0Daily spend limit
default_directionSIMMER_DIVERGENCE_DIRECTION(both)Filter: "bullish" or "bearish"

Update via CLI: python ai_divergence.py --set max_bet_usd=10

How It Works

Divergence Signal

Each imported market has two prices:

  • AI consensus (current_probability) — Simmer's AI consensus price, derived from multi-model ensemble forecasting
  • External price (external_price_yes) — Real market price on Polymarket/Kalshi

divergence = AI consensus - external price

When divergence > 0: AI thinks the market is underpriced → buy YES When divergence < 0: AI thinks the market is overpriced → buy NO

Kelly Sizing

Position size uses the Kelly criterion:

kelly_fraction = edge / (1 - price)
position_size = kelly_fraction * max_bet_usd

Capped at kelly_cap (default 25%) to limit risk.

Fee Filtering

75% of Polymarket markets have 0% fees. The remaining 25% charge 10% (short-duration crypto/sports). This skill only trades zero-fee markets to avoid fee drag eroding the edge.

Safeguards

  • Fee check: Skips markets with any taker fee
  • Flip-flop detection: Uses SDK's context API to detect contradictory trades
  • Position check: Skips markets where you already hold a position
  • Daily budget: Stops trading when daily spend limit is reached
  • Kelly sizing: Conservative sizing prevents over-betting

API Endpoints Used

  • GET /api/sdk/markets/opportunities — Divergence-ranked market list
  • GET /api/sdk/context/{market_id} — Fee rate and safeguards per market
  • POST /api/sdk/trade — Trade execution (via SDK client)
  • GET /api/sdk/positions — Current portfolio positions

Troubleshooting

"No markets above min edge threshold" → All divergences are below the min_edge setting. Lower it with --set min_edge=0.01 or wait for larger divergences.

"Daily budget exhausted" → The skill has hit its daily spend limit. Adjust with --set daily_budget=50.

All markets skipped for fees → Only zero-fee markets are traded. If all available divergence opportunities have fees, no trades execute. This is by design.

"context fetch failed" → The SDK context endpoint is rate-limited (18 req/min). If running frequently, reduce max_trades_per_run.

Comments

Loading comments...