ClawHub

Polymarket Clob Microstructure

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed Polymarket trading bot, but it needs review because live mode can place repeated real-money trades through a scheduled automaton.

Install only if you intentionally want an automated Polymarket/Simmer trading scanner. Keep it in dry-run first, use the least-privileged Simmer key available, confirm the cron behavior, and do not enable live scheduled trading without your own exposure, loss, and monitoring limits.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This code performs a safety-critical operation by submitting live trades when `--live` is set, but it does not prompt for confirmation immediately before execution. Although the CLI help mentions real trades and logging is present, there is no interactive acknowledgement or equivalent guard at the point of irreversible action.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
global _client
    if _client is None:
        _client = SimmerClient(
            api_key=os.environ["SIMMER_API_KEY"],
            venue=os.environ.get("TRADING_VENUE", "sim")
        )
    return _client
Confidence
80% confidence
Finding
os.environ["SIMMER_API_KEY"]

Env Variable Harvesting

High
Category
Data Exfiltration
Content
datefmt="%H:%M:%S",
    )

    if not os.environ.get("SIMMER_API_KEY"):
        log.error("SIMMER_API_KEY not set")
        sys.exit(1)
Confidence
70% confidence
Finding
os.environ.get("SIMMER_API_KEY

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal