Polymarket Edge Liquidity
Analysis
The skill is coherent and not malicious, but it deserves review because it can use a Simmer API key to run an automated trading strategy and place live trades when enabled.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
parser.add_argument("--live", action="store_true", help="Execute trades") ... result = client.trade(market_id, side, trade_amount, source=TRADE_SOURCE, skill_slug=SKILL_SLUG, reasoning=reasoning)Live mode directly invokes the trading API. Although this is the stated purpose and dry-run is the default, the artifact does not show per-trade approval, a daily loss/exposure cap, or reversibility once --live is used.
cron: "*/20 * * * *" ... automaton:\n managed: true\n entrypoint: "edge_liquidity.py"
The skill declares a managed scheduled automaton that runs every 20 minutes. This is disclosed and fits the market-scanning purpose, but it is persistent background behavior.
requires:\n pip: ["simmer-sdk"]
The skill depends on an unpinned external pip package. This is expected for a Simmer integration, but the artifact does not lock a version.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
SimmerClient(api_key=os.environ["SIMMER_API_KEY"], venue=os.getenv("TRADING_VENUE", "simmer"))The skill requires and uses a Simmer API key to access the trading service. This is expected for the purpose, and the artifacts do not show the key being logged or sent elsewhere.