Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Polymarket Copytrading

v1.0.0

Mirror positions from top Polymarket traders using Simmer API. Size-weighted aggregation across multiple wallets.

0· 74·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for richducat/dolph-copytrading.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Polymarket Copytrading" (richducat/dolph-copytrading) from ClawHub.
Skill page: https://clawhub.ai/richducat/dolph-copytrading
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install dolph-copytrading

ClawHub CLI

Package manager switcher

npx clawhub@latest install dolph-copytrading
Security Scan
Capability signals
CryptoRequires wallet
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The code and SKILL.md consistently implement Polymarket copytrading via the Simmer SDK and require a Simmer API key — which is coherent with the described purpose. However the top-level registry summary in the evaluation input said "Required env vars: none", while clawhub.json and the code clearly require SIMMER_API_KEY and pip dependency simmer-sdk. That metadata mismatch is a red flag (likely a packaging/manifest mistake) and should be resolved before trusting the skill.
Instruction Scope
Runtime instructions and code stay within the stated scope: fetching whale positions, aggregating, planning trades server-side, and executing trades client-side via the Simmer SDK. The skill will call Simmer API endpoints (including POST /api/sdk/copytrading/execute) and may make marketplace changes (import markets, place trades, set risk monitors). It does not, from the visible code, attempt to read unrelated system files or exfiltrate data to third-party endpoints beyond simmer.markets.
Install Mechanism
There is no explicit install spec in the package, but requirements.txt and clawhub.json list the PyPI package simmer-sdk. That is a typical approach (pip install simmer-sdk). This is moderate-risk only because pip packages can contain arbitrary code — you should inspect or pin the simmer-sdk package/version before installing.
!
Credentials
The skill needs an API credential (SIMMER_API_KEY) which is directly relevant to its purpose, but the manifest inconsistency (registry-level said no env vars while clawhub.json and code require SIMMER_API_KEY and the SKILL.md documents SIMMER_COPYTRADING_* env vars) is concerning. The single API key grants the skill the ability to place real trades and set risk monitors on your Simmer account; that is powerful and directly affects funds. The code also reads TRADING_VENUE and AUTOMATON_MAX_BET from the environment although those are not declared at the top-level metadata. Treat the API key as highly sensitive and only supply it after reviewing the simmer-sdk and confirming the exact permissions/scope.
Persistence & Privilege
always:false and autostart:false. clawhub.json marks the automaton as managed with entrypoint copytrading_trader.py, but it doesn't force inclusion or automatic startup. The skill will be able to execute trades when invoked, but it does not request permanent 'always' privilege or attempt to modify other skills' configs in the provided code.
What to consider before installing
Key points before installing or running this skill: - Metadata mismatch: The package manifest (clawhub.json and requirements.txt) requires SIMMER_API_KEY and the simmer-sdk package, but the evaluation header claimed no required env vars — assume SIMMER_API_KEY is required and verify the manifest before trusting the skill. - Sensitive credential: SIMMER_API_KEY can be used to execute real trades and set monitors on your Simmer account. Only provide it after you: - Inspect or verify the simmer-sdk package version (simmer-sdk>=0.9.19) and its source (PyPI/GitHub). Prefer pinned, audited releases. - Run the skill in paper-trade mode first (use --venue sim or let it auto-fallback to $SIM) and always use --dry-run to view the planned trades. - Test safely: Start with --dry-run and small max_usd (or SIM $SIM papers) and review the trade plan produced by the server endpoint before allowing live execution. - Review code: If you are not comfortable trusting the simmer-sdk package, inspect the library code (or run in an isolated environment) to confirm no unexpected network calls or credential exfiltration exist. - Environment hygiene: Be aware the skill reads additional env vars (TRADING_VENUE, AUTOMATON_MAX_BET, SIMMER_COPYTRADING_*) which were not declared in the top-level summary. Do not expose your primary production API key to untrusted or unanalyzed skills; consider creating a restricted/test API key if the platform supports it. - If anything about the manifest, package source, or behavior is unclear, treat the skill as risky until resolved. The primary danger here is financial (unauthorized trades), not hidden malware; diligence and testing in paper mode mitigate most risk.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ad2pejxkd3rsxeyz728wc9s8462k9
74downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Polymarket Copytrading

Mirror positions from successful Polymarket traders using the Simmer SDK.

This is a template. The default logic mirrors whale wallets by size-weighted allocation — remix it with your own wallet selection criteria, position filters, or rebalancing rules. The skill handles all the plumbing (wallet fetching, conflict detection, trade execution). Your agent provides the alpha.

When to Use This Skill

Use this skill when the user wants to:

  • Copytrade whale wallets on Polymarket
  • Paper trade (copytrade with $SIM) to test strategies without real money
  • Check what positions a wallet holds
  • Follow specific trader addresses
  • Check their copytrading positions

Quick Commands

# Check account balance and positions
python scripts/status.py

# Detailed position list
python scripts/status.py --positions

API Reference:

  • Base URL: https://api.simmer.markets
  • Auth: Authorization: Bearer $SIMMER_API_KEY
  • Portfolio: GET /api/sdk/portfolio
  • Positions: GET /api/sdk/positions

Finding Whale Wallets

  • predicting.top — Leaderboard of top Polymarket traders with wallet addresses
  • alphawhale.trade — Tools for copying and tracking top performers
  • Polymarket Leaderboard — Official rankings (requires account)

Quick Start (Ad-Hoc Usage)

User provides wallet(s) directly in chat:

User: "Copytrade this wallet: 0x1234...abcd"
User: "What positions does 0x5678...efgh have?"
User: "Follow these whales: 0xaaa..., 0xbbb..."

→ Run with --wallets flag:

python copytrading_trader.py --wallets 0x1234...abcd
python copytrading_trader.py --wallets 0xaaa...,0xbbb... --dry-run

This is the simplest way - no setup needed, just pass wallets directly.

Persistent Setup (Optional)

For automated recurring scans, wallets can be saved in environment:

SettingEnvironment VariableDefault
Target walletsSIMMER_COPYTRADING_WALLETS(none)
Top N positionsSIMMER_COPYTRADING_TOP_Nauto
Max per positionSIMMER_COPYTRADING_MAX_USD50
Max trades/runSIMMER_COPYTRADING_MAX_TRADES10

Top N auto-calculation (when not specified):

  • Balance < $50: Top 5 positions
  • Balance $50-200: Top 10 positions
  • Balance $200-500: Top 25 positions
  • Balance $500+: Top 50 positions

Polymarket Constraints:

  • Minimum 5 shares per order
  • SDK enforces $1.00 minimum position value (filters dust positions)

⚠️ Start Conservative: Begin with small amounts (--max-usd 5-10) and --dry-run to understand how the skill behaves before scaling up.

How It Works

By default, only buys execute. Pass --rebalance to also sell positions the whales have exited, or --whale-exits to sell only on whale exits.

Each cycle the script:

  1. Fetches positions from all target wallets via Simmer API
  2. Combines using size-weighted aggregation (larger wallets = more influence)
  3. Detects conflicts (one wallet long YES, another long NO) and skips those markets
  4. Scores by conviction: positions held by 2+ wallets get full sizing, single-wallet positions get 50% sizing
  5. Filters out drifted (>30% from entry) and stale (>90% or <10% price) positions
  6. Applies Top-N filtering to concentrate on highest-conviction positions
  7. Auto-imports missing markets from Polymarket
  8. Calculates rebalance trades to match target allocations
  9. Executes trades via Simmer SDK (respects spending limits)
  10. Reports results back to user

$SIM Paper Trading

Copytrading supports $SIM mode — mirror whale positions using simulated money on Simmer's LMSR markets. No wallet or USDC required.

# Paper trade with $SIM (explicit)
python copytrading_trader.py --venue sim --wallets 0x123... --live

# Auto-detect: if your account has no linked wallet, $SIM is used automatically
python copytrading_trader.py --wallets 0x123... --live

In $SIM mode:

  • Trades execute on Simmer's LMSR at real Polymarket prices
  • Each market gets an independent $10K $SIM balance
  • Positions tracked in your Simmer portfolio (source: sdk:copytrading)
  • Whale signals still come from real Polymarket data

Running the Skill

Run a scan (dry run by default — no trades):

python copytrading_trader.py

Execute real trades:

python copytrading_trader.py --live

Check positions only:

python copytrading_trader.py --positions

View current config:

python copytrading_trader.py --config

Override wallets for one run:

python copytrading_trader.py --wallets 0x123...,0x456...

Full rebalance mode (includes sells):

python copytrading_trader.py --rebalance

Sell when whales exit positions:

python copytrading_trader.py --whale-exits

Reporting Results

After each run, message the user with:

  • Current configuration (wallets, Top N, max position)
  • Number of wallets fetched and total positions found
  • Markets skipped due to conflicts
  • Trades executed (or skipped with reason)
  • Current portfolio positions

Example output to share:

🐋 Copytrading Scan Complete

Configuration:
• Following 2 wallets
• Top 10 positions, max $50 each
• Balance: $250.00 USDC

Fetched positions:
• 0x1234...abcd: 15 positions
• 0x5678...efgh: 22 positions
• Combined: 28 unique markets
• Conflicts skipped: 2

Top 10 by allocation:
1. "Will BTC hit $100k?" - 18.5% → BUY YES
2. "Trump pardons X?" - 12.3% → BUY NO
3. "Fed rate cut Jan?" - 9.8% → Already held
...

Trades executed: 4 buys ($180 total)
• Bought 45 YES shares on "Will BTC hit $100k?" @ $0.82
• Bought 120 NO shares on "Trump pardons X?" @ $0.15
...

Next scan in 4 hours.

Example Conversations

User: "Copytrade 0x1234...abcd" → Run: python copytrading_trader.py --wallets 0x1234...abcd → Report what positions that wallet has and what trades would execute

User: "What is 0x5678...efgh holding?" → Run: python copytrading_trader.py --wallets 0x5678...efgh --dry-run → Show their positions without trading

User: "Follow these wallets: 0xaaa..., 0xbbb..., 0xccc..." → Run: python copytrading_trader.py --wallets 0xaaa...,0xbbb...,0xccc... → Aggregate positions across all wallets, report results

User: "Copytrade this whale but only top 5 positions" → Run: python copytrading_trader.py --wallets 0x... --top-n 5

User: "How are my positions doing?" → Run: python copytrading_trader.py --positions → Show current Polymarket positions with P&L

User: "Show copytrading config" → Run: python copytrading_trader.py --config → Display current settings

User: "Sell positions that whales have exited" → Run: python copytrading_trader.py --whale-exits → Compares your positions to whales, sells any they've closed

User: "Do a full rebalance to match the whales" → Run: python copytrading_trader.py --rebalance → Includes both buys AND sells to match whale allocations

Finding Good Wallets to Follow

Common approaches:

  1. Leaderboard tracking: Check Polymarket leaderboards for consistent performers
  2. Whale watchers: Follow known profitable traders on social media
  3. Specific strategies: Follow wallets known for weather, politics, or crypto trades

The skill works best when:

  • Following 2-5 wallets with overlapping strategies (e.g. all politics-focused, or all crypto-focused)
  • Wallets have similar conviction — mixing very different traders means most positions only appear in one wallet and get reduced sizing (50%)
  • Wallets trade markets available on Polymarket

Conviction Tiers

When following multiple wallets, positions are scored by conviction:

  • High conviction (held by 2+ wallets): full position sizing (max_usd)
  • Low conviction (held by 1 wallet): 50% position sizing

High-conviction positions are prioritized in Top N selection. Single-wallet positions still trade, but with reduced size. Using just 1 wallet disables conviction scoring (all positions get full sizing).

Troubleshooting

"Order too small" / "below minimum (5)"

  • Polymarket requires minimum 5 shares per order
  • Increase --max-usd or reduce --top-n to concentrate into fewer positions

"No wallets specified"

  • Provide wallet addresses in your message, e.g., "copytrade 0x1234..."
  • Or set SIMMER_COPYTRADING_WALLETS environment variable for recurring scans

"Agent has no USDC balance"

  • Need USDC in your Polymarket wallet, or use --venue sim for $SIM paper trading
  • Check wallet is linked at simmer.markets/dashboard

"Conflict skipped"

  • Wallets disagree on this market (one long YES, other long NO)
  • Markets with net position < 10% are skipped

"All N positions filtered (X conflicts, Y drifted, Z stale)"

  • All whale positions were removed by safety filters
  • Try different target wallets, or reduce to 1 wallet to disable conviction scoring
  • Drift filter skips positions where price moved >30% from whale's entry
  • Stale filter skips near-resolved markets (price >90% or <10%)

"Insufficient balance"

  • Not enough USDC for all trades
  • Reduce SIMMER_COPYTRADING_TOP_N or SIMMER_COPYTRADING_MAX_USD

"Market could not be imported"

  • Some markets may not be importable (resolved, private, etc.)
  • These are skipped automatically

"External wallet requires a pre-signed order"

  • WALLET_PRIVATE_KEY is not set in the environment
  • The SDK signs orders automatically when this env var is present — no manual signing code needed
  • Fix: export WALLET_PRIVATE_KEY=0x<your-polymarket-wallet-private-key>
  • Do NOT attempt to sign orders manually or modify the skill code — the SDK handles it

"Balance shows $0 but I have USDC on Polygon"

  • Polymarket uses USDC.e (bridged USDC, contract 0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174) — not native USDC
  • If you bridged USDC to Polygon recently, you likely received native USDC
  • Swap native USDC to USDC.e, then retry

Comments

Loading comments...