Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Polymarket Copytrading
v1.0.0Mirror high-performing whale wallets on Polymarket. Monitors configured wallet addresses for recent trades above a size threshold and copies them automatical...
⭐ 1· 29·0 current·0 all-time
byDC@chokle
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill is a Polymarket copytrader and legitimately needs a SIMMER_API_KEY and the simmer-sdk; Polymarket CLOB/Gamma public APIs are used for reads. However the included clawhub.json config instructs the agent to run copytrading.py with --live on a 15-minute cron, which is not obvious from the SKILL.md (which emphasizes dry-run by default). Automating live trades on install is a disproportionate operational decision relative to the simple stated purpose.
Instruction Scope
SKILL.md instructions stay within the copytrading domain (install simmer-sdk, set SIMMER_API_KEY, configure wallet list and thresholds). The Python code only reads declared SIMMER_* env vars and hits Polymarket public APIs plus the Simmer SDK. There is no sign the instructions ask for unrelated files/credentials or exfiltrate arbitrary data.
Install Mechanism
No arbitrary downloads or extract steps are present. The package relies on pip installing simmer-sdk (declared in clawhub.json), which is an expected and traceable dependency for integrating with Simmer.
Credentials
Only SIMMER_API_KEY (and optional SIMMER_COPYTRADE_* variables) are required — these are proportional for a skill that places trades via Simmer. No unrelated third-party secrets or system credentials are requested.
Persistence & Privilege
The skill is not 'always: true', but clawhub.json config sets 'automaton.managed: true' with a cron of */15 and entrypoint args ['--live'], meaning if deployed through the automaton it will autonomously execute live trades every 15 minutes. This contradicts the SKILL.md 'dry run default' statement and materially increases risk (automatic financial actions without an explicit opt-in each run).
What to consider before installing
Key things to consider before installing:
- The code itself looks coherent for copytrading and only needs your SIMMER_API_KEY and simmer-sdk, but the included deployment metadata (clawhub.json) will schedule the skill to run with --live every 15 minutes. That means once installed as an automaton it can place real trades automatically — contrary to the SKILL.md message that dry-run is the default. If you plan to install, do one of the following first: (1) run the script locally in dry-run to validate behavior; (2) remove or edit clawhub.json so the automaton does not pass --live (or remove the cron) before deployment; or (3) install with a limited/sandbox Simmer API key (paper trading or restricted scopes) so accidental live trades can't cause real losses. Also review and set the SIMMER_COPYTRADE_MAX_POSITION, MAX_TRADES, and MIN_TRADE env vars to conservative values, and examine the default whale wallet list before mirroring. If you are not comfortable with a skill that can autonomously execute live trades on a schedule, do not install the managed automaton config as-is.Like a lobster shell, security has layers — review code before you run it.
latestvk975kaq9w0dhgz5xa6323wjtvd847mqx
License
MIT-0
Free to use, modify, and redistribute. No attribution required.