Back to skill
Skillv0.0.3
ClawScan security
Polymarket Twitter Bin Decay Trader · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 28, 2026, 2:33 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with its stated purpose (time-decay trading for post-count bin markets via the Simmer SDK), requests only a Simmer API key and tunable env vars, and defaults to safe paper mode — review the simmer-sdk before providing live credentials.
- Guidance
- This skill appears to do what it says: it uses the Simmer SDK and an API key to discover markets and place trades, and defaults to paper trading unless you pass --live. Before installing: (1) correct or confirm the metadata discrepancy (the package files require SIMMER_API_KEY but the top-level summary omitted it), (2) inspect the simmer-sdk source on PyPI/GitHub to ensure the client behaves as expected and has no unexpected network or credential handling, (3) keep any live SIMMER_API_KEY out of environments where automation could run --live inadvertently, and (4) test thoroughly in paper/sim mode and constrain tunables (max position, min trade) before enabling live trades. If you need higher assurance, ask the publisher for a security audit or run the skill in an isolated account with limited funds.
Review Dimensions
- Purpose & Capability
- okName/description, SKILL.md, clawhub.json and trader.py all describe trading Polymarket post-count bin markets and require the Simmer SDK and SIMMER_API_KEY; those requirements are appropriate for the stated functionality.
- Instruction Scope
- okSKILL.md and trader.py confine actions to market discovery and trading via the SimmerClient. The docs suggest optional remixing with Twitter scraping or APIs, but the shipped code does not perform unrelated file reads or exfiltrate data. The runtime uses only declared env vars and the Simmer SDK client.
- Install Mechanism
- noteNo install script is included (instruction-only install assumed). The declared dependency is the publicly-published 'simmer-sdk' on PyPI/GitHub; this is reasonable but you should audit the simmer-sdk source before giving live credentials.
- Credentials
- noteThe code uses a single primary secret (SIMMER_API_KEY) plus SIMMER_-prefixed tunables. That is proportionate to a trading skill. Note: the top-level summary in the evaluation metadata claimed 'Required env vars: none', whereas clawhub.json and SKILL.md explicitly require SIMMER_API_KEY — this metadata inconsistency should be corrected before install.
- Persistence & Privilege
- okThe skill does not request always:true, autostart is false, and the automaton entrypoint is managed but will not start automatically. disable-model-invocation is not set (normal). It does not attempt to modify other skills or system-wide configs.