Skillv1.0.0

ClawScan security

Aion Test Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignApr 27, 2026, 5:55 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's code, documentation, and requested environment variables are consistent with an automated Polymarket trading template; nothing in the package indicates it is trying to perform unrelated actions or exfiltrate unexpected credentials.
Guidance: This package appears to be a coherent trading template, but exercise caution before enabling live trading: 1) Only provide AION_API_KEY and WALLET_PRIVATE_KEY if you trust the source — the private key (if supplied) can move your funds. Prefer managed (AION) wallets when possible. 2) Test extensively in dry-run mode and inspect the calculate_signal() implementation before enabling live trades. 3) Review the installed aion-sdk package (source/version on PyPI or repository) and audit the momentum_trader.py file for any modifications if you did not obtain this skill from a trusted publisher. 4) Limit the environment scope (run in an isolated account or with minimal funds) until you are confident in behavior. 5) Keep backups of any secrets and rotate keys if you suspect misuse.

Review Dimensions

Purpose & Capability: okName/description (momentum Polymarket trading) match the included files and runtime behavior: a Python trading script that uses an AION SDK client to discover markets, analyze momentum, execute trades and redeem winnings. Declared dependencies (aion-sdk, requests) and required env var AION_API_KEY are appropriate for this purpose.
Instruction Scope: okSKILL.md and the python code limit activity to polling AION for briefings/market context, performing analysis, and calling SDK methods to trade or redeem. The instructions reference only the declared env vars and AION endpoints; they do not direct the agent to read arbitrary local files or other unrelated secrets. Live trading is explicit and requires --live; dry-run is default.
Install Mechanism: okNo opaque download/install is included. The package is instruction-only plus a Python file and requirements.txt (pip packages aion-sdk and requests). Installing via pip is the expected, low-to-moderate risk mechanism for this kind of skill.
Credentials: noteThe primary required credential is AION_API_KEY (declared and used). WALLET_PRIVATE_KEY is listed as optional for self-custody trading — this is sensibly optional but highly sensitive: providing it grants the skill the ability to sign and move funds. No unrelated secrets or excessive env variables are requested.
Persistence & Privilege: okThe skill is not always: true and does not request elevated platform privileges. clawhub.json marks the entrypoint and a cron schedule, which is consistent with a scheduled trading skill. The skill does not modify other skills or system-wide agent settings.