Simmer Skill Builder

What to check before installing or giving credentials: - Reconcile the mismatch: the registry metadata reported no required env vars but the package contains a clawhub.json and templates that require SIMMER_API_KEY and the simmer-sdk. Assume the skill needs SIMMER_API_KEY unless the publisher explicitly confirms otherwise. - Do NOT supply live wallet private keys (WALLET_PRIVATE_KEY, SOLANA_PRIVATE_KEY) or other private signing keys to this skill or to generated skills unless you fully audited the generated code. The Simmer docs note those are only required for specific real venues; generated skills could include them. - Audit the generated skill folder before running it. The generator will write Python scripts and config files to disk and may instruct the agent to run them. Run scripts in a sandbox or review code manually (look for network endpoints, unexpected POSTs, or obfuscated behavior). - Use a limited (paper/sim) API key or a read-only credential when testing. The Simmer client supports simulated ('sim') venues — prefer those for initial testing. - Run scripts/validate_skill.py on any generated skill folder; it includes checks for common pitfalls. Also inspect clawhub.json to ensure automaton.managed and entrypoint are set as you expect. - Limit the agent's file-write and network permissions if possible; avoid letting it autonomously install or execute newly generated code until you verify it. Confidence notes: The package contents and templates strongly match the claimed purpose (generating Simmer trading skills), but clear inconsistencies between registry-declared requirements and the included files (and between the templates' expectations and the included clawhub.json) make the package suspicious until those mismatches are explained by the publisher.