中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:1 day ago Rescan
5 /100
polymarket-music-entertainment-trader
Trades Polymarket prediction markets on music streaming milestones, album chart performance, Grammy nominations, and entertainment deals.
Legitimate Polymarket trading bot with well-documented paper trading default, clean code, and no malicious indicators.
Skill Namepolymarket-music-entertainment-trader
Duration33.0s
Enginepi
✓
Safe to install
Safe to use. The skill implements clear trading logic with appropriate safeguards (paper mode default, --live flag requirement for real trades).

Findings 1 items

Severity Finding Location
Low
Dependency version not pinned Supply Chain
The simmer-sdk dependency in clawhub.json does not specify a version, which could lead to unexpected behavior if the package changes in future releases.
"pip": ["simmer-sdk"]
→ Pin to a specific version (e.g., "simmer-sdk>=1.0.0") to ensure reproducible behavior.
 clawhub.json:4
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No file operations in trader.py
Network READ READ ✓ Aligned API calls only through simmer-sdk to Polymarket, documented in SKILL.md
Shell NONE NONE — No subprocess or shell execution detected
Environment READ READ ✓ Aligned Reads SIMMER_API_KEY and SIMMER_* tunables, all documented in SKILL.md
Skill Invoke NONE NONE — No skill invocation capabilities
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser automation
Database NONE NONE — No database access
5 findings
🔗
Medium External URL 外部 URL
https://charts.spotify.com/charts/overview/global
SKILL.md:95
🔗
Medium External URL 外部 URL
https://www.billboard.com/charts/
SKILL.md:96
🔗
Medium External URL 外部 URL
https://chartmetric.com/
SKILL.md:97
🔗
Medium External URL 外部 URL
https://www.riaa.com/gold-platinum/
SKILL.md:98
📧
Info Email 邮箱地址
[email protected]
SKILL.md:150

File Tree

3 files · 18.8 KB · 466 lines
Python 1f · 241L Markdown 1f · 152L JSON 1f · 73L
├─ 📋 clawhub.json JSON 73L · 1.2 KB
├─ 📝 SKILL.md Markdown 152L · 7.3 KB
└─ 🐍 trader.py Python 241L · 10.3 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
simmer-sdk * pip No Version not pinned; published by Simmer Markets ([email protected])

Security Positives

✓ Paper trading default (venue="sim") ensures zero financial risk unless --live flag is explicitly passed
✓ No shell execution or subprocess calls detected
✓ No credential exfiltration - SIMMER_API_KEY only used for API authentication
✓ Clean, readable code with no obfuscation or base64-encoded payloads
✓ No sensitive file/path access (no ~/.ssh, ~/.aws, .env access)
✓ Cron disabled by default (autostart: false, cron: null)
✓ Clear documentation of all capabilities and dependencies
✓ Doc-to-code alignment: all functionality declared in SKILL.md matches implementation