Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Polymarket Signal Sniper

v1.5.2

Snipe Polymarket opportunities from your own signal sources. Monitors RSS feeds with Trading Agent-grade safeguards.

0· 1.5k·10 current·10 all-time
byAD88@adlai88

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for adlai88/polymarket-signal-sniper.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Polymarket Signal Sniper" (adlai88/polymarket-signal-sniper) from ClawHub.
Skill page: https://clawhub.ai/adlai88/polymarket-signal-sniper
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install polymarket-signal-sniper

ClawHub CLI

Package manager switcher

npx clawhub@latest install polymarket-signal-sniper
Security Scan
Capability signals
CryptoRequires walletRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The code and SKILL.md implement an RSS-based signal watcher that uses the simmer-sdk to call Simmer API and execute trades — this matches the 'Polymarket Signal Sniper' description. However the registry summary shown earlier (no required env vars / no primary credential) contradicts clawhub.json and the SKILL.md, both of which declare SIMMER_API_KEY as required and document WALLET_PRIVATE_KEY as an optional but highly sensitive credential.
!
Instruction Scope
The runtime instructions explicitly ask the user to install simmer-sdk, set SIMMER_API_KEY, and optionally put a wallet private key in the environment so the SDK can sign trades client-side. The skill's code polls RSS feeds, matches to markets, calls SDK 'context/safeguards' endpoints, and can execute live trades. That scope is consistent with the stated purpose but gives the skill (and the SDK it loads) the ability to autonomously place orders if run with live credentials — a high-impact capability that users must consciously enable.
Install Mechanism
No custom download/install step is embedded in the skill; the SKILL.md instructs pip install simmer-sdk and clawhub.json lists simmer-sdk in pip requirements. That's a standard package install path. There are no obscure URLs or archive-extract installs in the manifest.
!
Credentials
Requiring SIMMER_API_KEY is proportional to a client that calls Simmer's API. The skill also asks for WALLET_PRIVATE_KEY (optional) for self-custody trading; that is expected for direct on-chain/order signing but is very sensitive. There are multiple small inconsistencies in env var names between SKILL.md, code, and clawhub.json (e.g., SIMMER_SNIPER_CONFIDENCE vs SIMMER_SNIPER_CONFIDENCE_THRESHOLD, SIMMER_SNIPER_MAX_TRADES vs SIMMER_SNIPER_MAX_TRADES_PER_RUN), and the code also reads other envs like TRADING_VENUE and AUTOMATON_MAX_BET that aren't clearly declared in top-level metadata — these mismatches reduce transparency about what secrets/config are required.
!
Persistence & Privilege
The skill is not marked always:true, and autostart is false, but clawhub.json marks the automaton as managed with an entrypoint of signal_sniper.py, and the skill is written to persist state (state/processed.json) and can update its own config via simmer_sdk.skill helpers. Combined with the ability to use a wallet private key and the default of allowing autonomous model invocation, this creates a realistic path for automated live trades if credentials are present — a high-privilege action that users should consciously authorize.
What to consider before installing
What to check before installing or enabling this skill: - Metadata mismatch: The registry summary reported no required env vars, but the skill package (clawhub.json and SKILL.md) requires SIMMER_API_KEY and optionally WALLET_PRIVATE_KEY. Confirm which is authoritative before trusting the listing. - Sensitive secrets: This skill supports placing real trades. If you provide WALLET_PRIVATE_KEY (private key), the SDK will sign orders automatically. Prefer using a managed custodial wallet or a limited-scope API key rather than putting an unlocked private key in an environment variable. If you must use a private key, keep it in a secure secret store and rotate it frequently. - Autonomy and safeguards: The code is capable of making live trades. If you don't want autonomous actions, do not run with --live or set up the skill to run automatically, or disable autonomous model invocation/automaton features in your agent. Run in dry-run/scan-only mode first and verify behavior. - Confirm the SDK: Inspect the simmer-sdk package (its source and release channel) before installation. Ensure the package version matches expectations (clawhub.json requests simmer-sdk>=0.11.1). Verify simmer.markets is the legitimate service you intend to use. - Env var and tunable mismatches: The skill's SKILL.md, code, and clawhub.json use slightly different names for some environment variables/tunables. If you set an env var and the skill doesn't see it, it may default to different values. Review the code or run --config to confirm active settings. - Least privilege: Use the smallest API key permissions possible and limit MAX_USD/MAX_TRADES while testing. Consider network isolation/sandbox execution when trialing. - Files written locally: The skill writes a state/processed.json file in its directory. If you run this in a shared environment, ensure the directory's access permissions meet your security needs. If you want a higher-confidence assessment, provide: - The simmer-sdk package source or a link to its official repo/release so I can check what the SDK does when given credentials; and - Clarification which registry metadata (the summary shown vs clawhub.json) is the authoritative manifest so the declared requirements can be reconciled.

Like a lobster shell, security has layers — review code before you run it.

latestvk9766ty4f778r0dtyx3qz3vzhx85e2d2
1.5kdownloads
0stars
20versions
Updated 7h ago
v1.5.2
MIT-0

Polymarket Signal Sniper

Your signals, Simmer's trading intelligence.

This is a template. The default signal source is RSS feeds — remix it with any data source (APIs, webhooks, social media, custom scrapers). The skill handles all the plumbing (market matching, safeguards, trade execution). Your agent provides the alpha.

When to Use This Skill

Use this skill when the user wants to:

  • Monitor RSS feeds for trading opportunities
  • Trade on breaking news before markets react
  • Configure their own signal sources and keywords
  • Get Trading Agent-grade safeguards on their trades

Setup Flow

When user asks to install or configure this skill:

  1. Install the Simmer SDK

    pip install simmer-sdk
    
  2. Ask for Simmer API key

    • They can get it from simmer.markets/dashboard → SDK tab
    • Store in environment as SIMMER_API_KEY
  3. Ask for wallet private key (required for live trading)

    • This is the private key for their Polymarket wallet (the wallet that holds USDC)
    • Store in environment as WALLET_PRIVATE_KEY
    • The SDK uses this to sign orders client-side automatically — no manual signing needed
    • Not needed for $SIM paper trading on the Simmer venue

Quick Commands

# Check account balance and positions
python scripts/status.py

# Detailed position list
python scripts/status.py --positions

API Reference:

  • Base URL: https://api.simmer.markets
  • Auth: Authorization: Bearer $SIMMER_API_KEY
  • Portfolio: GET /api/sdk/portfolio
  • Positions: GET /api/sdk/positions

Quick Start (Ad-Hoc Usage)

User provides RSS feed and market directly:

User: "Watch this RSS feed for greenland news: https://news.google.com/rss/search?q=greenland"
User: "Snipe any news about trump from this feed"

→ Run with --feed and --market flags:

python signal_sniper.py --feed "https://news.google.com/rss/search?q=greenland" --market "greenland-acquisition" --dry-run

Persistent Setup (Optional)

For automated recurring scans, configure via environment:

SettingEnvironment VariableDefaultDescription
RSS FeedsSIMMER_SNIPER_FEEDS(none)Comma-separated RSS URLs
MarketsSIMMER_SNIPER_MARKETS(auto)Comma-separated market IDs (auto-discovers from keywords if empty)
KeywordsSIMMER_SNIPER_KEYWORDS(none)Comma-separated keywords to match
ConfidenceSIMMER_SNIPER_CONFIDENCE0.7Min confidence to trade (0.0-1.0)
Max USDSIMMER_SNIPER_MAX_USD25Max per trade
Max trades/runSIMMER_SNIPER_MAX_TRADES5Maximum trades per scan cycle

Polymarket Constraints:

  • Minimum 5 shares per order
  • Trades below this threshold are rejected with an error message

How It Works

Each cycle the script:

  1. Polls configured RSS feeds
  2. Filters articles by keywords (if configured)
  3. Matches articles to target markets (auto-discovers from keywords if no markets configured)
  4. For each match, calls SDK context endpoint for safeguards:
    • Position awareness (already holding?)
    • Flip-flop detection (recently changed direction?)
    • Slippage estimates (is market liquid?)
    • Time decay (resolving soon?)
    • Resolution criteria (what actually resolves this market?)
  5. If safeguards pass, infers trade direction from article sentiment
  6. Executes trade via SDK (with max trades per run cap)
  7. Tracks processed articles to avoid duplicates

Running the Skill

Run a scan (dry run by default — no trades):

python signal_sniper.py

Execute real trades:

python signal_sniper.py --live

Check for signals without trading:

python signal_sniper.py --scan-only

View current config:

python signal_sniper.py --config

Override for one run:

python signal_sniper.py --feed "https://..." --keywords "trump,greenland" --market "abc123"

Show processed articles:

python signal_sniper.py --history

Interpreting Context Warnings

Before trading, ALWAYS check the context warnings. The skill will show you:

WarningAction
MARKET RESOLVEDDo NOT trade
HIGH URGENCY: Resolves in XhConsider if signal is timely enough
flip_flop_warning: SEVERESkip - you've been reversing too much
flip_flop_warning: CAUTIONProceed carefully, need strong signal
Wide spread (X%)Reduce position size or skip
Simmer AI signal: X% more bullish/bearishConsider Simmer's oracle opinion

Analyzing Signals

When you find a matching article, analyze it carefully:

  1. Read the headline and summary - What is the actual news?

  2. Check resolution_criteria - What ACTUALLY resolves this market?

    • Example: "greenland" in headline doesn't mean "acquisition complete"
    • The resolution might be "US formally acquires Greenland by 2027"
    • Does this signal move the needle on THAT specific criteria?
  3. Assess confidence (0.0-1.0):

    • How directly does this signal relate to resolution criteria?
    • Is the source credible?
    • Is this news likely already priced in?
  4. Only trade if:

    • Confidence > threshold (default 0.7)
    • No severe warnings
    • Signal validates against resolution criteria

Example Conversations

User: "Set up news sniping for the Greenland market" → Ask for RSS feeds they want to monitor → Configure with market ID and keywords → Enable cron for recurring scans

User: "Check this feed for trading signals" → Run: python signal_sniper.py --feed "URL" --scan-only → Show found articles and potential matches

User: "Snipe any bitcoin news from CoinDesk" → Run with CoinDesk RSS and bitcoin-related markets → Show matches and ask if they want to trade

User: "What signals have we processed?" → Run: python signal_sniper.py --history → Show recent articles and actions taken

Example Trade Flow

1. RSS poll finds: "Trump and Denmark reach preliminary Greenland agreement"
2. Keywords match: "greenland", "trump"
3. Call context endpoint for market "greenland-acquisition-2027"
4. Check warnings: none severe ✓
5. Resolution criteria: "Resolves YES if US formally acquires Greenland by 2027"
6. You analyze: "preliminary agreement" ≠ "formally acquires" but bullish signal
7. Confidence: 0.75 (positive indicator, not definitive)
8. Check slippage: 2.5% on $25 ✓
9. Execute: BUY YES $25
10. Report: "🎯 Sniped: Trump/Greenland agreement → BUY YES $25"

Troubleshooting

"No feeds configured"

  • Provide feeds in message: "watch this RSS: https://..."
  • Or set SIMMER_SNIPER_FEEDS environment variable

"No matching articles found"

  • Check keywords are correct
  • RSS feed might not have recent articles
  • Try --scan-only to see what's in the feed

"Skipped due to flip-flop warning"

  • You've been changing direction too much on this market
  • Wait before trading again, or find new information

"Slippage too high"

  • Market is illiquid
  • Reduce trade size or skip

"Already processed"

  • This article was already seen
  • Working as intended (dedup)

"External wallet requires a pre-signed order"

  • WALLET_PRIVATE_KEY is not set in the environment
  • The SDK signs orders automatically when this env var is present — no manual signing code needed
  • Fix: export WALLET_PRIVATE_KEY=0x<your-polymarket-wallet-private-key>
  • Do NOT attempt to sign orders manually or modify the skill code — the SDK handles it

"Balance shows $0 but I have funds on Polygon"

  • Polymarket V2 (live 2026-04-28) uses pUSD (PolyUSD, 1:1 backed by USDC.e). If your wallet holds USDC.e, migrate at simmer.markets/dashboard with one click (~30s)
  • If you bridged native USDC (Circle), swap to USDC.e first, then migrate to pUSD
  • Full migration guide: docs.simmer.markets/v2-migration

Finding Good RSS Feeds

Tips for choosing signal sources:

  • Google News RSS: https://news.google.com/rss/search?q=YOUR_TOPIC
  • Niche sources: Better than mainstream (less priced in)
  • Official sources: Government, company announcements
  • Twitter lists → RSS: Use services like Nitter or RSS.app

The skill works best when:

  • Feeds are relevant to your target markets
  • You have specific keywords to filter noise
  • Sources publish before mainstream coverage

Comments

Loading comments...