Back to skill
Skillv0.0.3
ClawScan security
Polymarket Bundle Tennis Set Match Trader · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 28, 2026, 2:28 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and declared requirements are coherent with a Polymarket arbitrage trader: it only requires a Simmer trading API key, defaults to paper trading, and contains no obvious unrelated accesses or hidden endpoints.
- Guidance
- This skill appears to do what it says: detect cross-market tennis arbitrage and trade via the Simmer SDK. Before installing: (1) Treat SIMMER_API_KEY as a high-value credential — only provide a key with the minimum privileges you accept (use paper/trading-limited keys if possible). (2) Keep default behavior in paper mode and test thoroughly before using --live. (3) Verify you trust the simmer-sdk package and the Simmer service (network calls will occur to that backend). (4) Review and set tunables (max position, min trade, etc.) to limits you are comfortable with. (5) If you want extra assurance, inspect the SimmerClient implementation (the skill delegates order placement to that client) and rotate credentials after testing.
Review Dimensions
- Purpose & Capability
- okName and description describe a Polymarket tennis-bundle trader and the bundle's logic; the code and clawhub.json only request the Simmer SDK and a SIMMER_API_KEY credential needed to place trades. No unrelated credentials, binaries, or platform access are requested.
- Instruction Scope
- okSKILL.md and trader.py limit actions to market discovery, parsing, constraint-checking, sizing, and trade execution via the Simmer SDK. The skill documents that it defaults to 'sim' (paper) and only does real trades with an explicit --live flag. It does not instruct reading arbitrary host files or unrelated environment variables.
- Install Mechanism
- okThere is no arbitrary download; dependencies are limited to the simmer-sdk PyPI package as declared in clawhub.json. No extract-from-URL or unknown binary installation is present.
- Credentials
- noteThe only required secret is SIMMER_API_KEY, which is proportionate because the skill places trades via Simmer. This key is high-value (trading authority) — the code reads other SIMMER_* tunables from environment but those have safe defaults. Ensure you understand the privileges of the API key you supply.
- Persistence & Privilege
- okautostart is false and always is not set; the skill is user-invocable and can run autonomously per platform defaults, which is expected for trading automata. The code tries to call apply_skill_config if available but does so safely and with exception handling.