Polymarket Cybersecurity Trader

ReviewAudited by ClawScan on May 10, 2026.

Overview

This appears to be a coherent Polymarket trading skill, but using it means trusting it and its SDK with an API key and any live trades you explicitly enable.

Install only if you are comfortable giving the skill a Simmer/Polymarket trading credential. Run in paper mode first, review the full code and dependency source if possible, and enable live trading only with tight position limits.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

If configured for live trading, the skill may be able to act through the connected account and affect real funds or positions.

Why it was flagged

The skill authenticates with a Simmer API key, which is expected for Polymarket trading but gives the skill delegated account capability.

Skill content

SimmerClient(
            api_key=os.environ["SIMMER_API_KEY"],
            venue=venue,
        )

Recommendation

Use a dedicated or limited API key if available, start in paper mode, and keep position limits low until you understand the strategy.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A live invocation could create financial exposure based on the skill's automated market selection and sizing logic.

Why it was flagged

The trading action is explicitly scoped to paper mode by default, but the same tool can place real Polymarket trades when live mode is enabled.

Skill content

live=False  venue="sim"  (paper trades  safe default).
    live=True   venue="polymarket" (real trades, only with --live flag).

Recommendation

Do not enable live mode unless you intend to trade; review the thresholds and tunables such as max position, max spread, and max open positions.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A future or unexpected version of the SDK could change behavior in a way that affects trading or credential handling.

Why it was flagged

The skill depends on an unpinned external Python package. That dependency is central to the stated purpose, but version pinning would make installs more reproducible.

Skill content

"pip": [
      "simmer-sdk"
    ]

Recommendation

Prefer a pinned, reviewed version of simmer-sdk and verify the package source before enabling live trading.