Polymarket Global Elections Trader

ReviewAudited by ClawScan on May 10, 2026.

Overview

This is a coherent automated Polymarket trading skill, but users should notice that it requires a Simmer API key and can place real trades only when explicitly run in live mode.

Install this only if you intend to use a trading automation. Start in paper mode, verify the simmer-sdk package source, provide only a revocable/scoped API key if possible, and enable live trading only after setting strict position limits you are comfortable losing.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If you run the skill in live mode, it may place real financial trades and could lose money.

Why it was flagged

The skill can switch from paper trading to real Polymarket trading. The explicit --live requirement is a meaningful safeguard, but users should understand that live mode can spend real funds.

Skill content

live=True  → venue="polymarket" (real trades, only with --live flag).

Recommendation

Use paper mode first, keep position limits low, and only enable --live after explicitly deciding to allow real trades.

Medium

#ASI03: Identity and Privilege Abuse

What this means

A valid API key may let the skill access your trading account or execute trades through the provider.

Why it was flagged

The skill requires a Simmer API key, which likely authorizes access to the trading service. This is expected for the purpose, but it is sensitive and the registry summary lists no required env vars or primary credential.

Skill content

"env": [
      "SIMMER_API_KEY"
    ]

Recommendation

Use a scoped or revocable API key if available, monitor account activity, and ensure the registry metadata clearly discloses the credential requirement.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A future or unexpected package version could change behavior, including how credentials or trades are handled.

Why it was flagged

The skill depends on an unpinned external package. This is normal for an SDK-based integration, but version pinning and package provenance would improve reviewability.

Skill content

"pip": [
      "simmer-sdk"
    ]

Recommendation

Pin the SDK version and install it only from a trusted package source.

Info

#ASI10: Rogue Agents

What this means

The skill is built to run as an automation when invoked, but the artifacts do not show it starting on its own.

Why it was flagged

The skill is configured as a managed automaton, but the provided configuration disables scheduled and autostart execution.

Skill content

"cron": null,
  "autostart": false,
  "automaton": {
    "managed": true,
    "entrypoint": "trader.py"
  }

Recommendation

Keep autostart and scheduled runs disabled unless you intentionally want unattended trading.