中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:1 day ago Rescan
5 /100
polymarket-macro-calendar-catalyst-trader
Trades Polymarket prediction markets that resolve near known calendar catalyst events (FOMC, sports, geopolitics, crypto, space launches)
A legitimate Polymarket trading bot that uses the simmer-sdk to trade prediction markets near calendar catalyst events, with no malicious behavior detected.
Skill Namepolymarket-macro-calendar-catalyst-trader
Duration30.4s
Enginepi
✓
Safe to install
This skill is safe to use. The SIMMER_API_KEY credential is required and documented, and all trading is paper-only by default.

Findings 1 items

Severity Finding Location
Low
Unpinned simmer-sdk dependency Supply Chain
The simmer-sdk dependency is not version-pinned, allowing any version to be installed. This creates a supply chain risk if a malicious version is published to PyPI.
"pip": ["simmer-sdk"]
→ Pin to a specific version, e.g., "simmer-sdk>=1.0.0,<2.0.0", to prevent silent upgrades.
 clawhub.json
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No file operations in code
Network NONE READ ✓ Aligned SDK calls to Polymarket/Simmer APIs only; no direct network from skill
Shell NONE NONE — No subprocess or shell invocation
Environment READ READ ✓ Aligned SKILL.md §Required Credentials declares SIMMER_API_KEY and tunables; code reads …
Skill Invoke NONE NONE — No inter-skill invocation
Clipboard NONE NONE — No clipboard access
Browser NONE NONE — No browser automation
Database NONE NONE — No database access

File Tree

3 files · 27.4 KB · 653 lines
Python 1f · 454L Markdown 1f · 108L JSON 1f · 91L
├─ 📋 clawhub.json JSON 91L · 1.9 KB
├─ 📝 SKILL.md Markdown 108L · 6.6 KB
└─ 🐍 trader.py Python 454L · 18.9 KB

Dependencies 1 items

PackageVersionSourceKnown VulnsNotes
simmer-sdk * pip No Version not pinned in clawhub.json

Security Positives

✓ Paper trading is the safe default; --live flag required for real trades
✓ No shell execution, subprocess, or command injection vectors
✓ No obfuscation (base64, eval, atob) anywhere in the codebase
✓ No sensitive file access (no ~/.ssh, ~/.aws, .env reads)
✓ No credential exfiltration — SIMMER_API_KEY is only used for SDK authentication
✓ No data exfiltration or C2 communication patterns
✓ Full documentation coverage: strategy, credentials, tunables, and safeguards all declared in SKILL.md
✓ clawhub.json is complete and accurate with all tunables declared
✓ Environment variable access is documented and limited to declared credential/tunable names