Back to skill
Skillv0.0.3
ClawScan security
Polymarket Central Bank Trader · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
ReviewApr 28, 2026, 2:21 PM
- Verdict
- Review
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's files indicate it requires a Simmer API key and a simmer-sdk dependency despite the SKILL.md and registry metadata saying 'no external API / no required env', which is an incoherence you should resolve before installing.
- Guidance
- Do not install or run this skill until the inconsistent manifests are resolved. Specifically: - Confirm whether the skill truly requires a Simmer account/API (SIMMER_API_KEY) and the simmer-sdk; the included clawhub.json and trader.py do require them even though SKILL.md and the registry summary claim none are needed. - Inspect the simmer-sdk package (PyPI page or source repo) to confirm what endpoints it contacts and whether it stores/forwards credentials. If possible, open the SDK code or run it in a network-limited sandbox first. - If you plan to run this skill, keep it in paper mode (no --live) until you audit behavior and provenance. Verify the --live switch is required to execute real trades and that the automaton won't enable live trading automatically. - Ask the skill author to reconcile documentation vs. manifest: the README/SKILL.md, clawhub.json, and registry metadata should match (required envs, dependencies, and behavior). Without this, the skill's claims are unreliable. - If you must proceed, restrict the SIMMER_API_KEY to an account with minimal privileges (test/paper trading only) and monitor outbound network activity when the skill runs. Confidence is medium because the mismatch is clear and suspicious, but there is nothing in the code that obviously attempts to exfiltrate unrelated secrets or perform other malicious actions.
Review Dimensions
- Purpose & Capability
- concernThe skill is a Polymarket trader so needing an execution/broker API is plausible. However: (a) SKILL.md repeatedly states 'no external API required', and (b) the registry summary reported 'required env vars: none'. The included clawhub.json lists 'SIMMER_API_KEY' and a pip dependency 'simmer-sdk' and the Python file imports SimmerClient. That mismatch (claims no API vs. code requiring an API key/SDK) is a substantive incoherence.
- Instruction Scope
- noteSKILL.md describes market discovery, sizing, and trade execution; trader.py implements these behaviors and defaults to paper trading unless --live is provided. The instructions do not appear to direct the agent to read unrelated system files or exfiltrate arbitrary data. The main scope concern is the SKILL.md claim 'no external API required' versus the code's use of SimmerClient (networked broker/service).
- Install Mechanism
- noteThere is no explicit install spec in the package registry metadata, but clawhub.json declares a pip dependency 'simmer-sdk'. Installing a third-party Python SDK from PyPI is moderate-risk and expected for a trading/execution skill, but you should verify the simmer-sdk package provenance and review its code or docs before granting credentials.
- Credentials
- concernThe code expects a SIMMER_API_KEY and many SIMMER_* tunables (MAX_POSITION, MIN_VOLUME, etc.) which are declared in clawhub.json. Requiring one API key for an execution/broker is proportionate to a trading bot. The concern is that the registry metadata shown to you omitted this required credential, so the manifest presented to users is inconsistent with the runnable files.
- Persistence & Privilege
- okThe skill is not marked always:true and does not request system-wide config or modify other skills. The automaton entrypoint will run trader.py if the automaton is enabled, but default behavior is paper trading and live trading requires an explicit --live flag.