Polymarket Emerging Tech Trader

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a disclosed Polymarket trading skill that defaults to paper trading, but it needs a Simmer API key and can place live trades if explicitly run in live mode.

Install only if you understand that this is an automated trading tool. Start in paper mode, verify the Simmer API key permissions, check whether any schedule is actually enabled, and review the risk limits before ever using `--live`.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If run with live trading enabled, the agent may spend funds and open prediction-market positions according to its automated rules.

Why it was flagged

The skill can submit trades through the Simmer client. This matches the stated purpose and defaults to simulation, but live mode would authorize real market actions.

Skill content

venue = "polymarket" if live else "sim" ... r = client.trade(... market_id=m.id, side=side, amount=size, ...)

Recommendation

Keep the default paper mode until you intentionally enable live trading, and review the max position, max open positions, spread, and minimum-days settings.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone or anything with the configured API key may be able to act through the connected Simmer/Polymarket account depending on the key's permissions.

Why it was flagged

The skill uses a Simmer API key to access the trading provider. This is expected for the integration, but it is a sensitive credential tied to account authority.

Skill content

SimmerClient(
            api_key=os.environ["SIMMER_API_KEY"],
            venue=venue,
        )

Recommendation

Use the least-privileged API key available, store it securely, monitor account activity, and revoke or rotate it if you stop using the skill.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Future installs could receive a different version of the SDK than the one originally tested.

Why it was flagged

The skill depends on an unpinned package. The dependency is purpose-aligned, but unpinned packages can change over time.

Skill content

"pip": [
      "simmer-sdk"
    ]

Recommendation

Install from trusted sources and prefer a pinned or reviewed SDK version when using this with live trading funds.

Low

#ASI10: Rogue Agents

What this means

A user may be unsure whether the trader will run periodically or only when invoked.

Why it was flagged

The documentation describes recurring automated operation, while the provided manifest shows no enabled cron/autostart. This looks like a documentation/configuration inconsistency rather than hidden persistence.

Skill content

Runs every 15 minutes (`*/15 * * * *`).

Recommendation

Before enabling live mode, confirm whether the skill is scheduled, how often it runs, and whether it remains in paper mode for unattended runs.