中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:1 day ago Rescan
5 /100
polymarket-resolution-lattice-trader
Trades Polymarket markets by detecting logical inconsistencies between related contracts such as earlier-vs-later deadlines and prerequisite-vs-downstream event chains.
This is a legitimate Polymarket trading strategy that detects cross-market logical inconsistencies. It has safe defaults (paper trading), no shell execution, no obfuscation, and all credential access is declared and necessary for trading.
Skill Namepolymarket-resolution-lattice-trader
Duration33.8s
Enginepi
✓
Safe to install
Approve for use. The skill is well-structured with clear safety mechanisms. Consider pinning the simmer-sdk version for reproducible builds.

Findings 1 items

Severity Finding Location
Low
Unpinned dependency version Supply Chain
simmer-sdk dependency has no version constraint (*), which could lead to unexpected behavior if a malicious or buggy version is published.
"pip": ["simmer-sdk"]
→ Pin to a specific version (e.g., "simmer-sdk==1.2.3") or a tight range (e.g., "simmer-sdk>=1.0.0,<2.0.0")
 clawhub.json:10
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No file operations in code
Network READ READ ✓ Aligned Uses SimmerClient SDK for API calls (trader.py:31)
Shell NONE NONE — No subprocess or shell execution detected
Environment READ READ ✓ Aligned Only reads declared SIMMER_* env vars (trader.py:58-65)
Skill Invoke NONE NONE — No skill invocation detected
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser automation
Database NONE NONE — No database access

File Tree

3 files · 21.3 KB · 628 lines
Python 1f · 403L Markdown 1f · 126L JSON 1f · 99L
├─ 📋 clawhub.json JSON 99L · 1.6 KB
├─ 📝 SKILL.md Markdown 126L · 5.0 KB
└─ 🐍 trader.py Python 403L · 14.7 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
simmer-sdk * pip No Version not pinned - recommend pinning to specific version

Security Positives

✓ Safe defaults: paper trading (sim) mode enabled by default with explicit --live flag required for real trades
✓ No shell execution or subprocess usage
✓ No obfuscation techniques (no base64, eval, or dynamic code execution)
✓ No sensitive path access (~/.ssh, ~/.aws, .env files)
✓ No credential exfiltration - only reads SIMMER_API_KEY for trading authentication
✓ All environment variable access is declared in SKILL.md
✓ Clear documentation with safety table explaining financial risk per execution mode
✓ No hidden functionality - code matches documented behavior
✓ Implements appropriate safeguards (flip-flop detection, slippage checks, position limits)
✓ Autostart disabled, cron null - no automatic execution without user configuration