polymarket-candle-harami-trader 安全扫描报告 — 可信 | ClawSafe

5 /100

polymarket-candle-harami-trader

Detects harami candlestick patterns on Polymarket crypto 5-minute interval markets and trades expected reversals with conviction-based sizing.

A legitimate Polymarket harami candlestick pattern trading skill with clean, documented behavior and no malicious indicators.

技能名称polymarket-candle-harami-trader

分析耗时35.2s

引擎pi

✓

可以安装

Approve for use. The skill performs exactly as documented: paper trading by default, credential-based API access via a declared SDK dependency, and no filesystem or shell operations.

安全发现 1 项

严重性	安全发现	位置
低危	Unpinned simmer-sdk dependency 供应链 clawhub.json declares 'simmer-sdk' without a version constraint, allowing any version to be installed. A compromised or backdoored future version could introduce risk. `"pip": ["simmer-sdk"]` → Pin to a specific version or version range: e.g., "simmer-sdk>=1.0.0,<2.0.0"	`clawhub.json:3`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`NONE`	—	No file read/write operations. Standard library only except simmer-sdk.
网络访问	`READ`	`READ`	✓ 一致	SimmerClient (simmer-sdk) makes API calls to Polymarket; declared in SKILL.md de…
命令执行	`NONE`	`NONE`	—	No subprocess, os.system, or shell command execution in trader.py
环境变量	`READ`	`READ`	✓ 一致	Reads SIMMER_API_KEY and 10 SIMMER_* tunables; all declared in SKILL.md Required…
技能调用	`NONE`	`NONE`	—	No inter-skill invocation
剪贴板	`NONE`	`NONE`	—	No clipboard access
浏览器	`NONE`	`NONE`	—	No browser automation
数据库	`NONE`	`NONE`	—	No database access

目录结构

3 文件 · 22.4 KB · 563 行

Python 1f · 373L Markdown 1f · 95L JSON 1f · 95L

├─ 📋 clawhub.json JSON 95L · 2.1 KB

├─ 📝 SKILL.md Markdown 95L · 6.4 KB

└─ 🐍 trader.py Python 373L · 13.9 KB

依赖分析 1 项

包名	版本	来源	已知漏洞	备注
`simmer-sdk`	`unpinned`	pip (PyPI)	否	No version constraint specified — any version will be installed

安全亮点

✓ Paper trading by default (venue='sim') eliminates financial risk without --live flag

✓ No subprocess, shell execution, or eval calls anywhere in the codebase

✓ No file system writes or sensitive path access (~/.ssh, ~/.aws, .env, etc.)

✓ No base64, obfuscation, or anti-analysis patterns

✓ No hidden functionality — code behavior matches SKILL.md documentation precisely

✓ No curl|bash or wget|sh remote script execution

✓ SIMMER_API_KEY is used only to initialize SimmerClient, not exfiltrated

✓ Network access is SDK-mediated and scoped to Polymarket trading API

✓ autostart=false and cron=null prevent silent automated execution