Back to skill
Skillv1.0.0
ClawScan security
Trading · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 15, 2026, 4:41 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's requests, instructions, and included code are consistent with a Polymarket fast-market trading tool that uses a Simmer API key and public price feeds; nothing in the package appears to request unrelated credentials or perform unexpected system access.
- Guidance
- This package appears internally coherent for trading Polymarket sprint markets using Simmer as the execution layer. Before installing or running it: (1) treat your SIMMER_API_KEY like a secret—only set it in controlled environments and never paste it into chat; (2) test extensively in dry-run mode and review the script (fastloop_trader.py) yourself — running with --live will execute real trades and risk funds; (3) run it in an isolated environment (container or restricted VM) if you are unsure of provenance; (4) note that the skill source/homepage is not provided in the metadata — verify the Simmer service and the skill owner independently to ensure you trust the third party handling trade execution.
Review Dimensions
- Purpose & Capability
- okName/description (Polymarket fast-loop trader) match the code and SKILL.md: the package discovers Polymarket sprint markets, computes CEX momentum signals (Binance by default), and uses the Simmer API to execute trades. The single required env var (SIMMER_API_KEY) is consistent with a broker/service API key used to place trades.
- Instruction Scope
- okThe runtime instructions and the script focus on trading: asking the user for SIMMER_API_KEY, configuring thresholds, and running the script (dry-run vs --live). There are no instructions to read unrelated system files, harvest other credentials, or send arbitrary data to unknown endpoints. The network calls in code (simmer.markets, gamma-api.polymarket.com, public price feeds such as Binance/coingecko) are aligned with the stated purpose.
- Install Mechanism
- okNo install spec is provided (instruction-only skill with an included script). Nothing is downloaded from arbitrary URLs or installed system-wide. The risk from installation is low, but note that a local Python script is included and will be executed when invoked.
- Credentials
- okOnly SIMMER_API_KEY is required (plus optional SIMMER_* env vars for configuration). That is proportionate for a skill that delegates trade execution to a third-party Simmer service. No unrelated secrets or high-privilege credentials are requested.
- Persistence & Privilege
- okThe skill is not always-enabled, and it does not request system-wide persistence or attempt to modify other skills. It writes/updates its own config.json in its directory, which is normal for a CLI script. Autonomous invocation is allowed by platform default but not flagged here on its own.