ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Horizon SDK

v0.5.5

v0.4.16 - Trade prediction markets (Polymarket, Kalshi) - positions, orders, risk management, Kelly sizing, wallet analytics, Monte Carlo, arbitrage, quantit...

⭐ 0· 715·0 current·0 all-time
byJesus@jesusmanuelrg
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (prediction-market trading, orders, positions, analytics) match the code and runtime instructions. The single required env var (HORIZON_API_KEY) is appropriate for an SDK that talks to market/wallet APIs. The CLI delegates to a 'horizon' package installed via pip, which is expected.
ℹ
Instruction Scope
SKILL.md limits actions to market discovery, orders, wallet analytics and feed management which matches the CLI. The CLI also accepts user-supplied HTTPS feed URLs; the script includes hostname and simple IP heuristics to block private hosts, but validation is syntactic and may not catch DNS-based redirects, IPv6 addresses, or DNS names resolving to private IPs. That residual SSRF risk is proportional to the feed feature but worth noting.
ℹ
Install Mechanism
Install is via pip (formula: horizon-sdk) which is appropriate for a Python SDK. Installing a third-party pip package executes untrusted code on the host and may pull additional dependencies—this is expected but carries the usual supply-chain risk; no arbitrary URL downloads or obscure installers were specified in the skill metadata.
✓
Credentials
Only HORIZON_API_KEY is required and declared as primaryEnv. That single credential aligns with the skill's purpose (API access to trading/wallet services). No unrelated secrets, config paths, or extra credentials are requested.
✓
Persistence & Privilege
always is false and the skill does not request system-wide persistence or modify other skills. Model invocation is enabled by default (normal). No elevated platform privileges are requested.
Assessment
This skill appears to be what it says: a Horizon SDK-based CLI for prediction-market trading that requires one API key (HORIZON_API_KEY) and installs a pip package (horizon-sdk). Before installing: 1) Verify the horizon-sdk package source (PyPI project page, maintainer, and repository) — pip packages run code on install and at runtime. 2) Use a least-privilege HORIZON_API_KEY (grant only necessary permissions) and avoid sharing it. 3) Run installation and the CLI in an isolated environment (virtualenv, container) if possible. 4) Be cautious when using start-feed with user-provided URLs: although the script enforces HTTPS and blocks obvious private hosts, DNS-based or IPv6 SSRF tricks can bypass simple checks — prefer well-known feed endpoints. 5) If you need higher assurance, review the horizon-sdk package source (and the horizon.tools code it uses) before granting API credentials.

Like a lobster shell, security has layers — review code before you run it.

kalshivk9763d8x5ckqkyht1r0vmp5asx81c6mxlatestvk9727hw2vyhse132v462rb8btn81gpbdpolymarketvk9763d8x5ckqkyht1r0vmp5asx81c6mxprediction-marketsvk9763d8x5ckqkyht1r0vmp5asx81c6mxtradingvk9763d8x5ckqkyht1r0vmp5asx81c6mx

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvHORIZON_API_KEY
Primary envHORIZON_API_KEY

Install

Horizon SDK (pip install horizon-sdk)

Comments