Scan Report
10 /100
polymarket-global-elections-trader
Trades Polymarket prediction markets on elections, referendums, and democratic events worldwide
A legitimate Polymarket election trading bot that uses keyword-based market discovery and conviction-based sizing. No malicious behavior detected; all functionality is accurately documented in SKILL.md.
Safe to install
No immediate action required. Consider pinning the simmer-sdk version for reproducibility.
Findings 1 items
| Severity | Finding | Location |
|---|---|---|
| Low | Unpinned SDK dependency Supply Chain | clawhub.json:5 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | NONE | — | No file I/O in trader.py |
| Network | NONE | READ | ✓ Aligned | simmer-sdk makes outbound API calls to Polymarket; indirectly required for tradi… |
| Shell | NONE | NONE | — | No subprocess, os.system, or shell execution |
| Environment | READ | READ | ✓ Aligned | trader.py:51-59 reads SIMMER_* vars for configuration |
| Skill Invoke | NONE | NONE | — | No skill-to-skill invocation |
| Clipboard | NONE | NONE | — | No clipboard access |
| Browser | NONE | NONE | — | No browser automation |
| Database | NONE | NONE | — | No database access |
File Tree
3 files · 27.6 KB · 587 lines Python 1f · 385L
Markdown 1f · 129L
JSON 1f · 73L
├─
clawhub.json
JSON
├─
SKILL.md
Markdown
└─
trader.py
Python
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
simmer-sdk | * | pip | No | Version not pinned; PyPI package from SpartanLabsXyz |
Security Positives
✓ Safe paper-trading default (venue="sim" unless --live flag is explicitly provided)
✓ No shell execution, file writes, or credential harvesting beyond the declared SIMMER_API_KEY
✓ Documentation accurately describes all behavior — no hidden functionality
✓ No obfuscation techniques (no base64, eval, or anti-analysis patterns)
✓ Guards against slippage and flip-flop trades via context_ok() function
✓ No network requests made directly — all API calls go through the simmer-sdk
✓ Cron/automaton disabled by default (autostart: false)