Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Polymarket Weather Trader

v1.0.0

Trade Polymarket weather markets using NOAA (US) and Open-Meteo (international) forecasts via Simmer API. Inspired by gopfan2's $2M+ strategy. Use when user...

0· 86·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for richducat/dolph-weather-trader.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Polymarket Weather Trader" (richducat/dolph-weather-trader) from ClawHub.
Skill page: https://clawhub.ai/richducat/dolph-weather-trader
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install dolph-weather-trader

ClawHub CLI

Package manager switcher

npx clawhub@latest install dolph-weather-trader
Security Scan
Capability signals
CryptoRequires wallet
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated goal (trading Polymarket using Simmer forecasts) aligns with the code: it calls NOAA/Open-Meteo and the Simmer API and requires the simmer-sdk. However SKILL.md instructs the user to provide and store a wallet private key (WALLET_PRIVATE_KEY) for live trading, while the bundle metadata (clawhub.json and top-level registry summary) either omit or inconsistently list required env vars. Asking for a private key is plausible for live automated trading, but the credential is not declared consistently in the skill manifest, which is an incoherence and a security concern.
!
Instruction Scope
Runtime instructions explicitly tell the agent to ask for and store sensitive secrets (SIMMER_API_KEY and a wallet private key) and to save many runtime tunables as environment variables; they also advise setting up cron for scheduled runs. Collecting and storing private keys in environment variables is risky and the instructions do not provide secure alternatives (e.g., hardware wallet, local signing, ephemeral signing). The SKILL.md gives the agent broad authority to 'save settings to environment variables' which could lead to secrets being persisted in agent runtime environment without adequate safeguards.
Install Mechanism
There is no download/install script in the bundle (instruction-only plus code files), which reduces some risk. clawhub.json declares a pip dependency on 'simmer-sdk' — a normal package installable from PyPI (moderate risk typical of pip packages). There is an inconsistency between the top-level 'Requirements' summary (which claimed no required env vars) and clawhub.json (which lists SIMMER_API_KEY), but there are no download-from-unknown-URL install steps or archive extraction in the package.
!
Credentials
The skill requires and documents many tunable env vars (entry/exit thresholds, sizing, vol targeting), which is reasonable for a trading bot. The notable issue: SKILL.md instructs the user to supply WALLET_PRIVATE_KEY (sensitive) for live trading, but the manifest does not clearly declare this required credential. The bundle's recorded requirements are inconsistent, and the runtime guidance to store private keys in environment variables is disproportionately risky relative to the stated description unless the user is explicitly warned and given safer alternatives.
Persistence & Privilege
always: false and autostart: false minimize forced persistence. The automaton is marked 'managed' with an entrypoint weather_trader.py, meaning the system can run the script when invoked, and the skill supports scheduling (user must enable cron). Autonomous invocation is allowed (platform default). Combined with the request for a wallet private key this increases potential impact (automated trades if enabled), so users should be cautious before providing live-trading credentials or enabling scheduling.
What to consider before installing
This skill appears to implement a coherent weather-trading bot, but there are important red flags you should address before installing or providing secrets: - Do not paste your main wallet private key into an environment variable without understanding how it will be used and stored. SKILL.md asks for WALLET_PRIVATE_KEY for live trading but the package manifest does not consistently declare it — ask the author why the credential is omitted from the declared requirements and how the key is consumed. - Prefer safer signing methods: hardware wallet, ephemeral signing, or local-only signing; if the Simmer SDK supports injecting a signing callback rather than reading a raw private key, use that. - Run in dry-run mode first (the script supports a non-live/dry-run) and inspect behavior. Use a dedicated, funded test/trading wallet with minimal funds if you must test live trading. - Audit the 'simmer-sdk' package source (PyPI/GitHub) before installing; verify the package is official and inspect what it does with API keys and private keys. - Because the skill can be scheduled/autonomous, avoid enabling cron/autostart until you trust its operation and secrets handling. - Ask the skill author to: (1) explicitly declare all required environment variables (including WALLET_PRIVATE_KEY if needed), (2) document how private keys are used/stored and whether they are transmitted anywhere, and (3) provide secure signing alternatives or documented instructions for minimizing risk. If you are not comfortable providing a private key or enabling automated trading, do not install or do not enable live/scheduled mode. If you proceed, use limited funds and rotate keys after testing.

Like a lobster shell, security has layers — review code before you run it.

latestvk976vdfn9gxhjtpny801jnpejx846dyv
86downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Polymarket Weather Trader

Trade temperature markets on Polymarket using NOAA forecast data.

This is a template. The default signal is NOAA temperature forecasts — remix it with other weather APIs, different forecast models, or additional market types (precipitation, wind, etc.). The skill handles all the plumbing (market discovery, NOAA parsing, trade execution, safeguards). Your agent provides the alpha.

When to Use This Skill

Use this skill when the user wants to:

  • Trade weather markets automatically
  • Set up gopfan2-style temperature trading
  • Buy low on weather predictions
  • Check their weather trading positions
  • Configure trading thresholds or locations

What's New in v1.17.0

  • Volatility Targeting: Dynamic position sizing based on realized market volatility. Uses EWMA of log returns from price history. High vol → smaller positions, low vol → larger positions. Enable with --vol-targeting flag or SIMMER_WEATHER_VOL_TARGETING=true.
    • SIMMER_WEATHER_TARGET_VOL — target annualized vol (default 20%)
    • SIMMER_WEATHER_VOL_MAX_LEVERAGE — max scale-up multiplier (default 2.0x)
    • SIMMER_WEATHER_VOL_MIN_ALLOC — min allocation floor (default 20%)
    • SIMMER_WEATHER_VOL_SPAN — EWMA responsiveness (default 10)

v1.14.0

  • Fixed env var names to match autotune registry (old names still work as aliases):
    • SIMMER_WEATHER_ENTRYSIMMER_WEATHER_ENTRY_THRESHOLD
    • SIMMER_WEATHER_EXITSIMMER_WEATHER_EXIT_THRESHOLD
    • SIMMER_WEATHER_MAX_POSITIONSIMMER_WEATHER_MAX_POSITION_USD
    • SIMMER_WEATHER_MAX_TRADESSIMMER_WEATHER_MAX_TRADES_PER_RUN
  • New tunable: SIMMER_WEATHER_SLIPPAGE_MAX — adjustable slippage safeguard (default 15%). Set higher for research mode on illiquid markets.
  • New tunable: SIMMER_WEATHER_MIN_LIQUIDITY — skip markets with liquidity below this USD threshold (default 0 = disabled). Pre-filters thin markets before execution.
  • SIMMER_WEATHER_LOCATIONS and SIMMER_WEATHER_BINARY_ONLY now exposed as autotune tunables.

v1.13.0

  • Binary Only Mode: New SIMMER_WEATHER_BINARY_ONLY config to skip range-bucket events (e.g., "NYC 34-35°F") and only trade binary yes/no weather markets

v1.2.0

  • Max Trades Per Run: New SIMMER_WEATHER_MAX_TRADES config to limit trades per scan cycle (default: 5)

v1.1.1

  • Status Script: New scripts/status.py for quick balance and position checks
  • API Reference: Added Quick Commands section with API endpoints

v1.1.0

  • Source Tagging: All trades tagged with sdk:weather for portfolio tracking
  • Smart Sizing: Position sizing based on available balance (--smart-sizing)
  • Context Safeguards: Checks for flip-flop warnings, slippage, time decay
  • Price Trend Detection: Detects recent price drops for stronger signals

Setup Flow

When user asks to install or configure this skill:

  1. Ask for Simmer API key

    • They can get it from simmer.markets/dashboard → SDK tab
    • Store in environment as SIMMER_API_KEY
  2. Ask for wallet private key (required for live trading)

    • This is the private key for their Polymarket wallet (the wallet that holds USDC)
    • Store in environment as WALLET_PRIVATE_KEY
    • The SDK uses this to sign orders client-side automatically — no manual signing needed
  3. Ask about settings (or confirm defaults)

    • Entry threshold: When to buy (default 15¢)
    • Exit threshold: When to sell (default 45¢)
    • Max position: Amount per trade (default $2.00)
    • Locations: Which cities to trade (default NYC)
  4. Save settings to environment variables

  5. Set up cron (disabled by default — user must enable scheduling)

Configuration

SettingEnvironment VariableDefaultDescription
Entry thresholdSIMMER_WEATHER_ENTRY_THRESHOLD0.15Buy when price below this
Exit thresholdSIMMER_WEATHER_EXIT_THRESHOLD0.45Sell when price above this
Max positionSIMMER_WEATHER_MAX_POSITION_USD2.00Maximum USD per trade
Max trades/runSIMMER_WEATHER_MAX_TRADES_PER_RUN5Maximum trades per scan cycle
LocationsSIMMER_WEATHER_LOCATIONSNYCComma-separated cities (NYC, Chicago, Seattle, Atlanta, Dallas, Miami)
Binary onlySIMMER_WEATHER_BINARY_ONLYfalseSkip range-bucket events (e.g., "34-35°F"), only trade binary yes/no markets
Smart sizing %SIMMER_WEATHER_SIZING_PCT0.05% of balance per trade
Slippage maxSIMMER_WEATHER_SLIPPAGE_MAX0.15Skip trades with slippage above this (0.15 = 15%)
Min liquiditySIMMER_WEATHER_MIN_LIQUIDITY0Skip markets with liquidity below this USD amount (0 = disabled)
Vol targetingSIMMER_WEATHER_VOL_TARGETINGfalseEnable volatility targeting for dynamic position sizing
Target volSIMMER_WEATHER_TARGET_VOL0.20Target annualized volatility (0.20 = 20%)
Vol max leverageSIMMER_WEATHER_VOL_MAX_LEVERAGE2.0Max scale-up multiplier in calm markets
Vol min allocSIMMER_WEATHER_VOL_MIN_ALLOC0.2Min allocation floor in volatile markets (0.2 = 20%)
Vol EWMA spanSIMMER_WEATHER_VOL_SPAN10EWMA span for vol calculation (lower = more responsive)

Legacy env var aliases (still accepted for backwards compatibility): SIMMER_WEATHER_ENTRY, SIMMER_WEATHER_EXIT, SIMMER_WEATHER_MAX_POSITION, SIMMER_WEATHER_MAX_TRADES

Supported locations: NYC, Chicago, Seattle, Atlanta, Dallas, Miami

Quick Commands

# Check account balance and positions
python scripts/status.py

# Detailed position list
python scripts/status.py --positions

API Reference:

  • Base URL: https://api.simmer.markets
  • Auth: Authorization: Bearer $SIMMER_API_KEY
  • Portfolio: GET /api/sdk/portfolio
  • Positions: GET /api/sdk/positions

Running the Skill

# Dry run (default — shows opportunities, no trades)
python weather_trader.py

# Execute real trades
python weather_trader.py --live

# With smart position sizing (uses portfolio balance)
python weather_trader.py --live --smart-sizing

# Check positions only
python weather_trader.py --positions

# View config
python weather_trader.py --config

# Disable safeguards (not recommended)
python weather_trader.py --no-safeguards

# Disable trend detection
python weather_trader.py --no-trends

# Enable volatility targeting (dynamic sizing based on market vol)
python weather_trader.py --live --smart-sizing --vol-targeting

# Quiet mode — only output on trades/errors (ideal for high-frequency runs)
python weather_trader.py --live --quiet

# Combine: frequent scanning, minimal noise
python weather_trader.py --live --smart-sizing --quiet

How It Works

Each cycle the script:

  1. Fetches active weather markets from Simmer API
  2. Groups markets by event (each temperature day is one event)
  3. Parses event names to get location and date
  4. Fetches NOAA forecast for that location/date
  5. Finds the temperature bucket that matches the forecast
  6. Safeguards: Checks context for flip-flop warnings, slippage, time decay
  7. Trend Detection: Looks for recent price drops (stronger buy signal)
  8. Entry: If bucket price < threshold and safeguards pass → BUY
  9. Exit: Checks open positions, sells if price > exit threshold
  10. Tagging: All trades tagged with sdk:weather for tracking

Smart Sizing

With --smart-sizing, position size is calculated as:

  • 5% of available USDC balance (configurable via SIMMER_WEATHER_SIZING_PCT)
  • Capped at max position setting ($2.00 default)
  • Falls back to fixed size if portfolio unavailable

This prevents over-deployment and scales with your account size.

Volatility Targeting

With --vol-targeting, position sizes are dynamically adjusted based on realized market volatility:

position_size = base_size × clamp(target_vol / realized_vol, min_alloc, max_leverage)
  • High volatility (price swinging): positions scale down → less risk
  • Low volatility (price stable): positions scale up → more alpha capture
  • Falls back to base size if insufficient price history (< 15 data points)

Combines with smart sizing: first calculate base size from portfolio %, then apply the vol multiplier.

Safeguards

Before trading, the skill checks:

  • Flip-flop warning: Skips if you've been reversing too much
  • Slippage: Skips if estimated slippage > 15%
  • Time decay: Skips if market resolves in < 2 hours
  • Market status: Skips if market already resolved

Disable with --no-safeguards (not recommended).

Source Tagging

All trades are tagged with source: "sdk:weather". This means:

  • Portfolio shows breakdown by strategy
  • Copytrading skill won't sell your weather positions
  • You can track weather P&L separately

Example Output

🌤️ Simmer Weather Trading Skill
==================================================

⚙️ Configuration:
  Entry threshold: 15% (buy below this)
  Exit threshold:  45% (sell above this)
  Max position:    $2.00
  Locations:       NYC
  Smart sizing:    ✓ Enabled
  Safeguards:      ✓ Enabled
  Trend detection: ✓ Enabled

💰 Portfolio:
  Balance: $150.00
  Exposure: $45.00
  Positions: 8

📍 NYC 2026-01-28 (high temp)
  NOAA forecast: 34°F
  Matching bucket: 34-35°F @ $0.12
  💡 Smart sizing: $2.00 (capped at max position)
  ✅ Below threshold ($0.15) - BUY opportunity! 📉 (dropped 15% in 24h)
  Executing trade...
  ✅ Bought 62.5 shares @ $0.12

📊 Summary:
  Events scanned: 12
  Entry opportunities: 1
  Trades executed: 1

Troubleshooting

"Safeguard blocked: Severe flip-flop warning"

  • You've been changing direction too much on this market
  • Wait before trading again

"Slippage too high"

  • Market is illiquid, reduce position size or skip

"Resolves in Xh - too soon"

  • Market resolving soon, risk is elevated

"No weather markets found"

  • Weather markets may not be active (seasonal)

"External wallet requires a pre-signed order"

  • WALLET_PRIVATE_KEY is not set in the environment
  • The SDK signs orders automatically when this env var is present — no manual signing code needed
  • Fix: export WALLET_PRIVATE_KEY=0x<your-polymarket-wallet-private-key>
  • Do NOT attempt to sign orders manually or modify the skill code — the SDK handles it

"Balance shows $0 but I have USDC on Polygon"

  • Polymarket uses USDC.e (bridged USDC, contract 0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174) — not native USDC
  • If you bridged USDC to Polygon recently, you likely received native USDC
  • Swap native USDC to USDC.e, then retry

"API key invalid"

  • Get new key from simmer.markets/dashboard → SDK tab

Comments

Loading comments...