Polymarket Candle Engulfing Reversal Trader

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  0.0.3

Overview

This is a disclosed automated Polymarket trading skill that defaults to paper trading and only uses live trading when explicitly run with the live flag.

Install only if you are comfortable with an automated trading bot. Start in paper mode, protect and scope the Simmer API key where possible, review the `simmer-sdk` dependency, and use `--live` only with small limits and active monitoring.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The manifest declares a required API credential and configures an automated trading entrypoint, but it provides no user-facing disclosure that the skill can place trades or consume a sensitive key. In a trading context, this omission can mislead users about the level of trust and financial risk involved, increasing the chance of unauthorized or poorly understood automated actions.

VirusTotal

65/65 vendors flagged this skill as clean.