Prediction Market Arbitrage

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: prediction-market-arbitrage Version: 1.0.0 The skill bundle is classified as benign. It serves as a meta-skill to orchestrate existing OpenClaw skills (`topic-monitor`, `polymarket-odds`, `simmer-weather`) for a prediction market arbitrage workflow. While it involves potentially sensitive actions like trade execution, the `SKILL.md` explicitly includes strong guardrails for the AI agent, such as requiring explicit user confirmation before any live trading action, mandating dry-runs, and rejecting stale data. There is no evidence of intentional harmful behavior, data exfiltration, backdoors, or prompt injection designed to subvert the agent's intended function or bypass security measures. The commands provided are standard for managing and interacting with OpenClaw skills.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If a live-capable key is available and the user later asks for execution, trades or account-impacting actions could occur through the referenced tools.

Why it was flagged

The skill discloses use of a Simmer API key and references live execution capability. That is expected for optional trading workflows, but it gives the agent access to financially meaningful account authority if configured.

Skill content

Requires `SIMMER_API_KEY`.
- Supports dry-run and live execution modes.
- Demonstrates guarded trading workflow and position checks.

Recommendation

Use alert-only or dry-run mode by default, provide the narrowest possible API key, and require manual confirmation of market, side, size, and maximum loss before any live trade.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Updating all installed skills could change other agent behavior or pull newer upstream code that was not part of this review.

Why it was flagged

The setup is user-directed, but it fetches latest versions and includes an update-all command that can modify more than this skill's immediate dependencies.

Skill content

npx -y clawhub@latest install topic-monitor
npx -y clawhub@latest install polymarket-odds
npx -y clawhub@latest install simmer-weather
npx -y clawhub@latest update --all

Recommendation

Install only the required skills, avoid `update --all` unless intended, and prefer pinned or reviewed versions before enabling a trading workflow.