Polymarket Resolution Lattice Trader
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This is a coherent Polymarket trading skill that defaults to paper trading, but users should review its live-trading mode, API-key authority, and external SDK dependency before enabling it.
Install this only if you intend to run a Polymarket trading strategy. Keep it in paper mode until you have reviewed the strategy and limits, protect SIMMER_API_KEY as a high-value credential, and require explicit approval before enabling --live trading.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If run with --live, the agent can risk real USDC according to the strategy and configured limits.
The skill can place real-money Polymarket trades when explicitly invoked in live mode. This is disclosed and purpose-aligned, but financially impactful.
Real trades only with `--live` flag. ... `python trader.py --live` | Live (polymarket) | Real USDC
Start in paper mode, use conservative tunables, and require explicit human approval before any live run.
Anyone with access to this credential may be able to operate the associated Simmer/Polymarket trading authority.
The skill requires an API key with trading authority. This is expected for the stated trading purpose, but it gives the skill sensitive account-level capability.
`SIMMER_API_KEY` | Yes | Trading authority. Treat as a high-value credential.
Use a dedicated, least-privilege key if available, rotate it if exposed, and do not install the skill in environments where untrusted agents can access the variable.
Future installs may receive a newer dependency version than the one the author tested.
The skill depends on an external Python package, and the artifact does not pin a package version. This is expected for the Simmer integration but adds dependency trust and update risk.
"pip": [
"simmer-sdk"
]Review the simmer-sdk package source and consider pinning a known-good version in controlled deployments.
A user may underestimate the setup and authority needed before reading the full skill instructions.
The registry summary says no credential is required, while SKILL.md and clawhub.json disclose SIMMER_API_KEY. This appears to be a metadata inconsistency rather than hidden behavior, but users relying only on the summary could miss the credential requirement.
Required env vars: none ... Primary credential: none
Treat the full artifact disclosures as authoritative and verify that SIMMER_API_KEY is intentionally provided only for this trading use.