Scan Report
5 /100
polymarket-48h-precipitation-range-trader
Trades mispricings in precipitation-range markets by reconstructing probability distributions across bins and detecting sum/monotonicity violations
Legitimate Polymarket precipitation-range trading bot with no malicious behavior, paper-trading by default, and clean implementation.
Safe to install
Approve for use. The skill is a well-documented trading bot that identifies probability distribution violations in Polymarket precipitation markets. No action required.
Findings 1 items
| Severity | Finding | Location |
|---|---|---|
| Low | simmer-sdk dependency not version-pinned Supply Chain | clawhub.json:6 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | NONE | — | No file read/write operations in trader.py |
| Network | READ | READ | ✓ Aligned | SDK connects to Polymarket API for market data and trade execution; declared in … |
| Shell | NONE | NONE | — | No subprocess or shell command execution in trader.py |
| Environment | READ | READ | ✓ Aligned | Reads SIMMER_API_KEY and risk tunables; credential used locally with SDK only |
File Tree
3 files · 29.2 KB · 767 lines Python 1f · 561L
Markdown 1f · 119L
JSON 1f · 87L
├─
clawhub.json
JSON
├─
SKILL.md
Markdown
└─
trader.py
Python
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
simmer-sdk | unpinned | pip | No | No version pin in clawhub.json; PyPI package without fixed version |
Security Positives
✓ Paper trading by default (venue="sim"), zero financial risk without explicit --live flag
✓ No subprocess or shell execution
✓ No sensitive file path access (~/.ssh, ~/.aws, .env, etc.)
✓ No credential exfiltration — SIMMER_API_KEY is used locally with the SDK only
✓ No obfuscation, base64 encoding, or anti-analysis techniques
✓ No hidden functionality — all behavior matches SKILL.md documentation
✓ Comprehensive safeguards: threshold gates, spread filters, flip-flop detection, max positions
✓ Clean code with no dynamic execution (no eval, exec, or ast.literal_eval misuse)