Back to skill
Skillv0.0.3
ClawScan security
Polymarket 48h Equity Strike Trader · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 28, 2026, 2:23 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's code, declared dependencies, and required environment variables are consistent with a Polymarket/Simmer trading bot that defaults to paper trading; no obvious incoherent or exfiltratory behavior is present in the provided files, but you should review the external simmer-sdk and be cautious with the live API key.
- Guidance
- This skill appears coherent for a Polymarket trading bot and defaults to paper trading, which is good. Before installing: 1) Review the simmer-sdk PyPI repo (and its GitHub) to verify there are no unexpected network calls or credential usages; 2) Use a limited-scope or simulation-only SIMMER_API_KEY while testing, and keep live trading keys offline until you fully trust the skill; 3) Run the skill in paper mode and inspect logs to verify behavior and that trades only occur when you pass --live; 4) Confirm the owner/repo trustworthiness (source/homepage is unknown here) and consider code-review or running in an isolated environment if you plan to use live funds. I have medium confidence because I can't inspect the simmer-sdk implementation or external runtime behavior from the provided files.
Review Dimensions
- Purpose & Capability
- okName/description (trading arbitrage on Polymarket) matches the code and declared requirements: trader.py uses a Simmer SDK client and expects SIMMER_API_KEY. The tunables and filters are declared in clawhub.json and referenced by the code. No unrelated credentials or binaries are requested.
- Instruction Scope
- okRuntime instructions and trader.py focus on market discovery, parsing, curve construction, violation detection, and trade execution. The code reads only SIMMER_API_KEY and SIMMER_* tunables (all declared). It does not reference other system paths, user files, shell history, or unexpected external endpoints in the provided files.
- Install Mechanism
- noteNo install script is provided, but clawhub.json declares a pip dependency on 'simmer-sdk'. Installing a third-party PyPI package is a normal dependency but does carry supply-chain risk — you should review the simmer-sdk package source/reputation before installing.
- Credentials
- okOnly one primary secret is required: SIMMER_API_KEY (trading authority). The skill also reads multiple SIMMER_* tunables (declared in clawhub.json). These variables are proportionate to a trading skill. No unrelated SECRET/TOKEN variables are requested.
- Persistence & Privilege
- noteautostart is false and the skill does not request always:true. The agent can invoke the skill autonomously (platform default), which is expected. Because the skill can place live trades if run with --live and has access to a trading API key, allowlisting/autonomy policies and key scoping should be considered before enabling autonomous runs.