Simmer Market Maker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:03 AM UTC
• Version: 1.0.0

Overview

This is a disclosed trading bot, but live use can cancel all open orders and place real trades with a broad API key, so it should be reviewed carefully before installation.

Install only if you understand that --live can place real orders and cancel existing open orders. Use paper mode first, use a dedicated trading account or scoped API key, do not run it in an account with unrelated active orders, pin/review simmer-sdk before installing, and avoid disabling safeguards unless you have independently reviewed the market and code behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:2

Finding

Unpinned Security-Sensitive Trading Dependency

Content

View full analysis

Remediation

View remediation

"] ``` 2. Replace the installation instruction with the same exact version constraint. 3. Use a lockfile or requirements file containing cryptographic hashes, and install with hash verification: ```bash pip install --require-hashes -r requirements.txt ``` 4. Retrieve packages only from an explicitly configured, trusted package index. 5. Review SDK release changes before upgrading rather than accepting automatic latest-version resolution. 6. Use a narrowly scoped API key with only the permissions necessary for this strategy. 7. Run the Skill in an isolated environment without unrelated secrets, sensitive files, or unnecessary operating-system privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: market_maker.py:204

Finding

Live Runs Cancel All Open Orders Without Strategy or Market Scoping

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: market_maker.py:399

Finding

Pre-Trade Safeguards Are Not Consistently Applied to NO Orders

Content

View full analysis

MAX_ORDER_USD / MIN_SHARES_PER_ORDER: reason = f"YES bid too high for min order at ${MAX_ORDER_USD}" print(f" ⚠ Skip YES: {reason}") skip_reasons.append(reason) else: # Safeguards if use_safeguards: context = get_market_context(market_id) should_trade, reasons = check_context_safeguards(context) if not should_trade: reason = "; ".join(reasons) print(f" 🛡 Safeguard blocked YES: {reason}") skip_reasons.append(reason) print() continue if reasons: print(f" ⚠ Safeguard warning: {'; '.join(reasons)}") reasoning = ( f"Market making YES bid: mid={mid:.3f}, quoting {yes_bid:.2f} " f"({SPREAD_OFFSET:.2f} below mid), vol_24h=${vol:,.0f}" ) if dry_run: print(f" [DRY RUN] Would place YES GTC limit @ {yes_bid:.2f} for ${MAX_ORDER_USD}") trades_attempted += 1 trades_executed += 1 else: trades_attempted += 1 result = execute_limit_order(market_id, "yes", MAX_ORDER_USD, yes_bid, reasoning) if result.get("success"): trades_executed += 1 print(f" ✓ YES limit placed @ {yes_bid:.2f} id={result.get('trade_id')}") elif result.get("skip_reason"): skip_reasons.append(result["skip_reason"]) print(f" ⚠ YES skipped: {result['skip_reason']}") else: err = result.get("error", "unknown error") execution_errors.append(err) print(f" ✗ YES failed: {err}") # NO side if no_bid > MAX_ORDER_USD / MIN_SHARES_PER_ORDER: reason = f"NO bid too high for min order at ${MAX_ORDER_USD}" print(f" ⚠ Skip NO: {reason}") skip_reaso ...[truncated 3149 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The function issues a broad DELETE to /api/sdk/orders, which appears to cancel all open orders without constraining the operation to orders associated with this strategy. In a trading context this is dangerous because it can silently interfere with unrelated active positions, destroy user intent, and trigger substantial financial loss through strategy interruption or missed fills.

Content

Scanner excerpt · market_maker.py (reported line 207)May include surrounding context.

python

def cancel_open_orders(dry_run=True):
    """Cancel all existing open orders via DELETE /api/sdk/orders."""
    if dry_run:
        print("  [DRY RUN] Would cancel open orders")
        return True

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill describes use of environment variables and live network-backed trading actions, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, this weakens reviewability and least-privilege controls, making it easier for the skill to access secrets and place or cancel orders without clear upfront authorization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The usage section advertises a '--live' mode for real-money trading and the strategy also cancels existing open orders before placing new ones, but it does not provide a prominent warning about financial loss, unintended order placement, cancellation churn, or market/execution risk. In this context, omission is dangerous because users may switch from dry run to live mode without understanding that the skill can immediately affect real positions and capital.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code claims Kalshi is unsupported for real trading, but the actual venue is taken from the TRADING_VENUE environment variable without enforcement. This mismatch can cause the strategy to operate against an unintended trading venue with different semantics, safeguards, or risk assumptions than the Polymarket-specific logic was designed for.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill unconditionally cancels all existing open orders before placing new ones, which exceeds the stated purpose of merely placing bid/ask limit orders for this strategy. In a shared trading account, this can disrupt unrelated user strategies or manually placed orders and create unintended financial exposure or lost opportunity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill's stated purpose is to find markets and place passive quotes, but the CLI also supports persisting configuration changes via --set and update_config(). Modifying local skill configuration is an auxiliary management capability that is not part of the declared trading function.

Content

No source excerpt is available for this finding.