Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Polymarket 48h Geopolitics Cluster Trader
v1.0.1Trades logical inconsistencies in geopolitical event clusters on Polymarket. Geopolitical markets form clusters where probabilities must satisfy constraints...
⭐ 0· 95·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's code (trader.py) and SKILL.md align: it discovers geopolitical markets and trades via a Simmer client. Requesting SIMMER_API_KEY is coherent with the stated purpose. However, the top-level registry summary earlier said "Required env vars: none" while both clawhub.json and SKILL.md require SIMMER_API_KEY — this metadata mismatch is inconsistent and should be resolved.
Instruction Scope
SKILL.md confines actions to market discovery, parsing, grouping, consistency checks, and trading. It explicitly defaults to paper trading and requires an explicit --live flag for real trades. The instructions do not ask for unrelated system files or secrets. Note: the skill asks the agent to 'provide the alpha' (user-supplied logic), which grants the agent discretion over trading signals but is within the described scope.
Install Mechanism
The skill was described as instruction-only, but clawhub.json declares a pip dependency ('simmer-sdk') and the package contains a Python entrypoint (trader.py). That means a Python runtime and a pip install of simmer-sdk will be required in practice — a moderate-risk install (public PyPI package) rather than 'no install'. Confirm the exact install workflow and verify the simmer-sdk package provenance before installing.
Credentials
Only one high-value credential is required: SIMMER_API_KEY, which is appropriate for a trading skill. The skill also reads several SIMMER_* tunables from env, which are expected. The earlier registry summary omission of SIMMER_API_KEY is inconsistent with clawhub.json/SKILL.md and should be corrected so users know a credential is required.
Persistence & Privilege
autostart is false and always is not set, so the skill won't run automatically without user action. The automaton entrypoint is present but managed; nothing requests permanent or elevated agent-wide privileges. The agent can still invoke the skill autonomously (platform default), but that is normal and not by itself a red flag.
What to consider before installing
This skill is coherent with its stated trading purpose, but several things to check before installing or running with real USDC:
- Metadata mismatch: the registry summary omitted required env vars, but both SKILL.md and clawhub.json require SIMMER_API_KEY. Treat SIMMER_API_KEY as a high-value credential and only provide it to trusted runtimes/accounts.
- Packaging/install: clawhub.json lists a pip dependency (simmer-sdk). Confirm how the environment installs that package and verify its source (PyPI package ownership and contents) before installing.
- Run in paper mode first: the code defaults to venue="sim"; test extensively with simulated funds and review logs and trade decisions before using --live.
- Code issues: the included trader.py has at least one bug (a function returns an undefined variable 'vi' instead of the violations list). Audit the Python code for correctness and edge cases (rate limits, API error handling) before enabling live trading.
- Limit exposure: if you decide to run live, use an API key/account funded with a strictly limited balance and set conservative tunables (max position, max positions, min trade).
- Verify apply_skill_config behavior: the client calls _client.apply_skill_config(SKILL_SLUG) if available — confirm that this call only pulls configuration and does not change unrelated agent settings or exfiltrate configs.
If you want, I can (1) scan the rest of trader.py for additional bugs or hidden behavior, (2) summarize the exact environment variable usage, or (3) produce a checklist to safely test this skill in a sandboxed Simmer environment.Like a lobster shell, security has layers — review code before you run it.
latestvk975rr3vydbvcq8n80qyybaa8s846fts
License
MIT-0
Free to use, modify, and redistribute. No attribution required.