Polymarket Weather Trader

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill is coherent for weather-market trading, but it can use a Simmer API key to place real trades if the user runs it in live mode.

Install only if you intend to let this skill analyze and potentially trade Polymarket weather markets through Simmer. Keep it in dry-run first, verify the publisher/provenance, protect the SIMMER_API_KEY, and use small position/trade limits before enabling live or scheduled runs.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If run in live mode, the skill can spend funds and create trading losses.

Why it was flagged

The skill can place real trades, but the documentation makes live mode explicit and presents dry-run as the default.

Skill content

python weather_trader.py --live  # Execute real trades

Recommendation

Start with dry-run, keep small max-position and max-trades settings, and avoid --no-safeguards unless you fully understand the risk.

Medium

#ASI03: Identity and Privilege Abuse

What this means

Anyone with this API key may be able to view account data or perform actions allowed by the Simmer API key.

Why it was flagged

The skill uses SIMMER_API_KEY as a bearer token for Simmer API account requests, which is expected for portfolio and trading operations.

Skill content

"Authorization": f"Bearer {api_key}"

Recommendation

Use a dedicated/revocable API key if available, store it securely, and rotate it if you stop using the skill.

Low

#ASI10: Rogue Agents

What this means

If scheduled in live mode, it could continue making trades without the user watching each run.

Why it was flagged

The skill can be scheduled for repeated automated trading, but the artifact says scheduling is disabled by default and requires user enablement.

Skill content

Set up cron (disabled by default — user must enable scheduling)

Recommendation

Do not enable cron/live quiet mode until you have tested dry-runs and set strict position and trade limits.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

It is harder to verify who maintains the skill and whether the reviewed package matches the published metadata.

Why it was flagged

The registry metadata lacks a public source/homepage and differs from the bundled _meta.json slug/version, which reduces provenance clarity for a financial-trading skill.

Skill content

Source: unknown; Homepage: none; Slug: weather-py; Version: 0.1.0

Recommendation

Verify the publisher and package contents before providing a trading API key or enabling live/scheduled trading.