polymarket-ai-tech-trader Security Report — Trusted | ClawSafe

5 /100

polymarket-ai-tech-trader

Trades Polymarket prediction markets on AI model releases, tech IPOs, product launches, and AI infrastructure milestones

A legitimate Polymarket trading skill with clear documentation, safe paper-trading defaults, and no suspicious behavior detected.

Skill Namepolymarket-ai-tech-trader

Duration27.9s

Enginepi

✓

Safe to install

No immediate action required. Consider pinning `simmer-sdk` to a specific version for reproducibility.

Findings 1 items

Severity	Finding	Location
Low	Unpinned dependency version Supply Chain simmer-sdk has no version constraint in clawhub.json pip requirements. While this is common practice for AI agent skills, it means the latest version would be installed, which could theoretically change behavior. `"pip": ["simmer-sdk"]` → Pin to a specific version: "simmer-sdk>=0.1.0,<1.0.0" or similar to ensure reproducible behavior.	`clawhub.json:6`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`NONE`	`NONE`	—	No file operations in trader.py
Network	`READ`	`READ`	✓ Aligned	client.find_markets() via simmer-sdk
Shell	`NONE`	`NONE`	—	No subprocess or shell commands
Environment	`READ`	`READ`	✓ Aligned	os.environ['SIMMER_API_KEY'] only
Skill Invoke	`NONE`	`NONE`	—	No skill invocation
Clipboard	`NONE`	`NONE`	—	No clipboard access
Browser	`NONE`	`NONE`	—	No browser automation
Database	`NONE`	`NONE`	—	No database access

3 files · 15.3 KB · 406 lines

Python 1f · 189L Markdown 1f · 144L JSON 1f · 73L

├─ 📋 clawhub.json JSON 73L · 1.2 KB

├─ 📝 SKILL.md Markdown 144L · 6.3 KB

└─ 🐍 trader.py Python 189L · 7.8 KB

Package	Version	Source	Known Vulns	Notes
`simmer-sdk`	`*`	pip	No	Version not pinned — would install latest

✓ Paper trading is the safe default (venue="sim")

✓ Real trades require explicit --live flag

✓ No shell/subprocess execution

✓ No credential harvesting or exfiltration

✓ No base64 encoding or obfuscation

✓ Documentation matches implementation exactly

✓ Clear risk parameters with safeguards (spread, days-to-resolution gates)

✓ Uses official simmer-sdk only for API calls

✓ No access to sensitive paths (~/.ssh, ~/.aws, .env)