polymarket-candle-three-soldiers-trader 安全扫描报告 — 可信 | ClawSafe

5 /100

polymarket-candle-three-soldiers-trader

Trades crypto 5-min interval markets on Polymarket by detecting Three White Soldiers and Three Black Crows candlestick continuation patterns

A legitimate Polymarket trading bot that detects Three White Soldiers / Three Black Crows candlestick patterns and executes paper or live trades via the simmer-sdk. No malicious indicators found.

技能名称polymarket-candle-three-soldiers-trader

分析耗时28.3s

引擎pi

✓

可以安装

No action needed. The skill is clean and well-documented. Consider pinning the simmer-sdk version in production for supply-chain stability.

安全发现 1 项

严重性	安全发现	位置
低危	Unpinned simmer-sdk dependency 供应链 The simmer-sdk dependency is declared in clawhub.json but without a version pin. This could allow a malicious or compromised future version to be installed. `"pip": ["simmer-sdk"]` → Pin the simmer-sdk to a specific version, e.g., "simmer-sdk==1.2.3"	`clawhub.json:3`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`NONE`	—	No Read/Write calls in trader.py
网络访问	`READ`	`READ`	✓ 一致	Uses SimmerClient (simmer-sdk) for market discovery and trade execution via HTTP…
命令执行	`NONE`	`NONE`	—	No subprocess, os.system, or shell execution in trader.py
环境变量	`READ`	`READ`	✓ 一致	Only reads SIMMER_* tunables documented in SKILL.md
技能调用	`NONE`	`NONE`	—	No inter-skill invocation
剪贴板	`NONE`	`NONE`	—	No clipboard access
浏览器	`NONE`	`NONE`	—	No browser automation
数据库	`NONE`	`NONE`	—	No direct database access

目录结构

3 文件 · 23.8 KB · 595 行

Python 1f · 411L Markdown 1f · 97L JSON 1f · 87L

├─ 📋 clawhub.json JSON 87L · 1.8 KB

├─ 📝 SKILL.md Markdown 97L · 6.2 KB

└─ 🐍 trader.py Python 411L · 15.7 KB

依赖分析 1 项

包名	版本	来源	已知漏洞	备注
`simmer-sdk`	`*`	pip	否	Version not pinned in clawhub.json -- supply-chain stability concern only

安全亮点

✓ No shell execution, subprocess, or os.system calls -- purely SDK-based

✓ No obfuscation, base64 encoding, or anti-analysis patterns

✓ No sensitive file access (~/.ssh, ~/.aws, .env, etc.)

✓ No credential exfiltration -- SIMMER_API_KEY used only for SimmerClient auth

✓ No data exfiltration to external IPs -- all API calls go to Simmer/Polymarket endpoints

✓ Paper trading is the safe default; --live flag required for real trades

✓ Comprehensive risk parameters documented and exposed as UI tunables

✓ Clear doc-to-code alignment: SKILL.md accurately describes trader.py behavior

✓ No hidden instructions, comments, or shadow functionality

✓ No persistence mechanisms (cron, startup hooks) unless explicitly configured in Simmer UI