polymarket-bundle-dota2-props-trader Security Report — Trusted | ClawSafe

5 /100

polymarket-bundle-dota2-props-trader

Trades bundle inconsistencies across correlated Dota 2 match props on Polymarket

A legitimate Polymarket Dota 2 props trading skill with transparent behavior, paper-trading defaults, and no security concerns found.

Skill Namepolymarket-bundle-dota2-props-trader

Duration24.2s

Enginepi

✓

Safe to install

Approve for use. The skill is well-documented, operates safely by default, and requires no additional scrutiny.

Resource	Declared	Inferred	Status	Evidence
Filesystem	`NONE`	`NONE`	—	No filesystem access in trader.py
Network	`READ`	`READ`	✓ Aligned	Uses SimmerClient SDK for Polymarket API calls only
Shell	`NONE`	`NONE`	—	No subprocess or shell execution found
Environment	`READ`	`READ`	✓ Aligned	Reads SIMMER_API_KEY and tuning env vars only
Skill Invoke	`NONE`	`NONE`	—	No skill invocation
Clipboard	`NONE`	`NONE`	—	No clipboard access
Browser	`NONE`	`NONE`	—	No browser access
Database	`NONE`	`NONE`	—	No database access

File Tree

3 files · 30.0 KB · 748 lines

Python 1f · 556L Markdown 1f · 105L JSON 1f · 87L

├─ 📋 clawhub.json JSON 87L · 1.8 KB

├─ 📝 SKILL.md Markdown 105L · 6.9 KB

└─ 🐍 trader.py Python 556L · 21.3 KB

Package	Version	Source	Known Vulns	Notes
`simmer-sdk`	`*`	pip	No	Official Simmer Markets SDK from PyPI; version not pinned but package is well-known

✓ Paper trading (venue='sim') is the default mode; live trading requires explicit --live flag

✓ Documentation is comprehensive and matches code behavior (SKILL.md matches trader.py)

✓ No shell execution or subprocess usage

✓ No filesystem writes or sensitive path access

✓ Credential access (SIMMER_API_KEY) is necessary and scoped to trading function; not exfiltrated

✓ Autostart is explicitly disabled (autostart: false, cron: null)

✓ Uses well-known PyPI package (simmer-sdk) from SpartanLabsXyz

✓ All trading parameters are declared as tunable in clawhub.json

✓ No obfuscation, base64, or hidden instructions found

✓ No remote script execution or curl|bash patterns

✓ Context safeguards (flip-flop, slippage checks) provide additional safety