MoltMarkets Trading Agent
WarnAudited by ClawScan on May 10, 2026.
Overview
This is a disclosed autonomous MoltMarkets bot, but it can use your API key to trade, create and resolve markets, and post comments on a silent schedule without per-action approval.
Install only if you deliberately want an always-on trading bot. Before enabling crons, verify the source and API domain, use a separate low-balance or scoped account, turn on notifications, reduce bet and market-creation limits, review the public comment style, monitor the memory files, and make sure you know how to disable or delete the scheduled jobs.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The bot could spend your MoltMarkets balance and post publicly from your account without you seeing or approving each action.
The scheduled agent can place authenticated bets and public comments repeatedly while suppressing intermediate messages; the artifacts include some risk controls, but no per-trade approval or global loss cap.
Trader Cron (Every 5 Minutes) ... Use POST /markets/{id}/comments endpoint after placing a bet ... OUTPUT RULES: ... work SILENTLY ... If no trades made → reply NO_REPLYRun manually first, keep crons disabled until tested, use a low-balance or scoped account, set notifications on, and add hard daily spend/loss caps plus per-action approval for large trades or public posts.
Once installed, the agents may keep acting while you are offline or unaware, including creating markets and resolving them.
The definitions create always-on scheduled agents for trading, market creation, and resolution that continue operating after setup, with silent/no-reply behavior by default.
enabled: true ... 'moltmarkets-trader' ... 'moltmarkets-creator-trigger' ... 'moltmarkets-resolution' ... OUTPUT: NO_REPLY
Only enable the recurring jobs if you intentionally want always-on automation; document how to stop them, start with disabled jobs, and require visible completion reports.
A MoltMarkets API key can let the agent act as you for trading and market operations; users may not be warned by metadata before installation.
The skill requires a bearer API key for account actions, but the provided registry requirements declare no primary credential or required config path.
Save your credentials ... ~/.config/moltmarkets/credentials.json ... "api_key": "mm_your_api_key_here"
Declare the credential requirement clearly, use the least-privileged/scoped key available, prefer a separate low-risk account, and revoke the key if you stop using the bot.
If the memory files become stale, corrupted, or edited unexpectedly, future trades and strategy changes may be based on bad state.
Persistent memory files are intentionally used to control future trading decisions and are shared across recurring agents.
Read these files FIRST: memory/trader-history.json — your trade history and category stats; memory/trader-learnings.md — patterns and categories to avoid/reduce
Keep the memory directory protected, review changes regularly, back up files, validate JSON before use, and reset or pause the bot after suspicious memory changes.
It is harder to verify that the skill and API instructions come from a trusted MoltMarkets source.
The skill provenance is not tied to an official source, which matters because it asks the user to run a setup script and configure credentialed trading automation.
Source: unknown; Homepage: none
Verify the publisher and API endpoint against official MoltMarkets documentation before running the script or adding credentials.