ClawHub

Polymarket Twitter Weekend Drift Trader

v1.0.1

Exploits systematic weekday/weekend posting rate differences in post-count bin markets. Requires SIMMER_API_KEY and simmer-sdk. Use when you want to capture...

⭐ 0· 48·0 current·0 all-time
by@diagnostikon
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
Crypto
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
ℹ
Purpose & Capability
The name/description (weekend-drift trader) align with the included code and the declared pip/env dependencies (simmer-sdk and SIMMER_API_KEY). One inconsistency: the top-level registry metadata in the prompt claimed "Required env vars: none", but both clawhub.json, SKILL.md, and trader.py require SIMMER_API_KEY — this is likely an inventory/metadata error rather than malicious intent.
✓
Instruction Scope
SKILL.md instructs installing the skill and running python trader.py (paper by default). The runtime instructions and the code stay within trading-related actions (market discovery, signal computation, optional live execution). The skill does not instruct reading arbitrary files or unrelated env vars, nor sending data to unknown endpoints in the provided source.
✓
Install Mechanism
There is no download/install script included; dependency is a PyPI package (simmer-sdk) enumerated in clawhub.json and SKILL.md. Using PyPI is a normal pattern; user should review the simmer-sdk package/source before trusting live keys, but the install mechanism itself is proportionate.
✓
Credentials
The only required secret is SIMMER_API_KEY and a set of SIMMER_* tunables (max position, thresholds, etc.). Those env vars are appropriate for a trading skill and are actually used by the code. The number and naming of environment variables are proportional to the described purpose.
✓
Persistence & Privilege
The skill does not request always:true, autostart is false, cron is null, and SKILL.md/code default to paper mode. The automaton entrypoint is present but not auto-started — privileges and persistence are appropriately limited.
Assessment
This package appears to be what it claims: a trading signal & execution template for Simmer/Polymarket. Before installing or providing credentials: (1) review the simmer-sdk PyPI project and its GitHub source to ensure it is authentic and contains no unexpected behavior; (2) keep a live SIMMER_API_KEY out of environments where unreviewed automation could run — test in paper mode first (the default); (3) verify autostart/cron remain disabled if you don't want scheduled runs; (4) note the metadata inconsistency: the registry summary showed no required env vars but the skill requires SIMMER_API_KEY — treat the latter as authoritative; (5) if you will enable live trading, audit the code paths that call client place/order functions and confirm risk-tunables are set appropriately. If you want, I can list the remaining functions in trader.py (truncated in the report) or scan the simmer-sdk repository for anything suspicious.

Like a lobster shell, security has layers — review code before you run it.

latestvk972cdt2ek9j78bkcfp3z38nh1846m3b

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments