Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Polymarket News Events
v1.0.0Monitors 20+ premium RSS feeds for breaking news and matches stories to Polymarket markets via keyword analysis. Trades when breaking news creates an estimat...
⭐ 0· 26·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Suspicious
medium confidencePurpose & Capability
The code imports simmer_sdk, feedparser and requests and uses SIMMER_API_KEY to instantiate a SimmerClient and place/check trades — this is coherent with "Polymarket News Events". RSS_FEEDS list ≈20 feeds and pre-filtering/impact-estimation logic matches the description. Notable mismatch: clawhub.json declares TRADING_VENUE as a required env var (and a cron schedule), while SKILL.md only documents SIMMER_API_KEY. There are also version/owner id inconsistencies between registry metadata, _meta.json, and clawhub.json.
Instruction Scope
SKILL.md instructs running news_events.py in dry-run by default and using --live to execute real trades; that matches the code's design (get_client reads SIMMER_API_KEY). The code writes a state file to /tmp to avoid re-trading (normal), fetches external RSS feeds, and calls the Simmer API. No instructions or code fragments were found that read unrelated system files or exfiltrate data to unexpected endpoints. However the manifest's cron entry (*/3 * * * *) implies scheduled autonomous runs every 3 minutes which is not surfaced in SKILL.md; this increases operational exposure and should be noted.
Install Mechanism
There is no install specification — dependencies are listed in SKILL.md and clawhub.json (simmer-sdk, requests, feedparser) but nothing will be auto-installed. That is not dangerous in itself but means the environment must provide those packages. No external archives or downloader URLs are present in the bundle.
Credentials
The skill requires SIMMER_API_KEY (appropriate for trading). clawhub.json also lists TRADING_VENUE as required; SKILL.md did not document this. The Simmer API key gives the skill authority to query markets and, when run with --live, to place real trades — a sensitive credential. The number of env vars is small and related to trading, but the manifest/metadata inconsistencies around required envs reduce confidence that the declared requirements are accurate.
Persistence & Privilege
always:false (not force-included), and disable-model-invocation is default false. However clawhub.json contains a cron schedule (*/3 * * * *) and an automaton entrypoint, so if the platform honors clawhub.json the skill may be scheduled to run frequently without further user prompting. That persistent/scheduled behavior should be confirmed and understood before enabling live mode.
What to consider before installing
This skill appears to do what it says (monitor RSS and trade via the Simmer/Polymarket SDK), but there are several red flags you should check before installing or enabling live trading:
- Credentials: The skill requires your SIMMER_API_KEY — this key can be used to query markets and place trades. Only provide it if you trust the code and the Simmer account permissions. Prefer a limited API key or an account with constrained permissions while testing.
- Dry-run vs live: SKILL.md says dry-run is default and --live executes real trades. Test extensively in dry-run mode and review logs to confirm behavior before passing --live.
- Manifest inconsistencies: clawhub.json lists TRADING_VENUE as a required env var and a cron schedule (every 3 minutes). SKILL.md did not document TRADING_VENUE and only described manual invocation. Confirm how the platform will schedule/autoinvoke the skill — you may get periodic autonomous runs if clawhub.json is used.
- Metadata mismatches: owner IDs and version numbers differ across registry metadata, _meta.json, and clawhub.json. These discrepancies may indicate edits, forks, or sloppy packaging; exercise extra caution and verify the source and maintainer identity.
- Dependencies & installation: There is no automated install step. Ensure required Python packages are installed in an isolated environment (virtualenv) before running. Review the full news_events.py file (the truncated share may hide additional logic) to confirm there are no hidden network calls or unexpected behavior.
- File writes and scheduling: The skill writes a state file to /tmp to avoid re-trading; confirm this is acceptable in your environment. If installed in a multi-tenant or persistent agent, the cron schedule could cause repeated activity — ensure that is intended.
What would increase confidence: a single consistent manifest (matching SKILL.md), an explicit install spec, clear maintainer identity or homepage, and a complete review of the full news_events.py file (verify the trading calls and any external endpoints the SimmerClient contacts). If you proceed, run in dry-run on an isolated account first and keep the API key scoped/minimal.Like a lobster shell, security has layers — review code before you run it.
latestvk97a6w09h9s1470wxzv11nb8ds846zfw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.