Trade Polymarket BTC 5-minute and 15-minute fast markets using CEX price momentum signals via Simmer API. Default signal is Binance BTC/USDT klines. Use when...
Security Analysis
medium confidenceThe skill appears to implement the stated Polymarket trading functionality, but there are inconsistencies about required credentials (notably a wallet private key) and some sensitive setup steps that are not declared in the registry metadata — review before installing or running live.
The skill's code and SKILL.md clearly require a Simmer API key and (for live trading) a wallet private key to sign orders. clawhub.json lists SIMMER_API_KEY and a pip dependency (simmer-sdk), but the top-level registry summary showed no required env vars and no primary credential. The omission of WALLET_PRIVATE_KEY from the declared requirements is an inconsistency — live trading legitimately needs signing credentials, but the metadata does not fully reflect that.
SKILL.md instructs the agent to ask for and store a wallet private key in the environment and to run the script on a cron loop. Those instructions are directly relevant to trading, but they also surface highly sensitive operations (storing and using a private key) and the skill asks to run automated, periodic live trades. The instructions do not describe any secure key-handling alternatives (hardware wallet, remote signing, or ephemeral signing).
This is instruction-only with an included Python script and a declared pip dependency on simmer-sdk (in clawhub.json). There is no download-from-URL or obscure install step in the manifest. Risk from installation is low provided dependencies are installed from trusted registries.
Requiring SIMMER_API_KEY and a wallet private key is proportionate to a skill that executes trades, but the private key is highly sensitive and is not declared in the registry metadata (clawhub.json only lists SIMMER_API_KEY). The SKILL.md explicitly asks users to store WALLET_PRIVATE_KEY in the environment, which is risky without guidance on secure handling. There is also a minor mismatch between env var names used in code/config (e.g., SIMMER_* vs. SIMMER_FASTLOOP_*) and the metadata which could confuse users.
The skill is not set to always:true, autostart is false, and scheduling is user-driven (cron or OpenClaw cron). The skill can be invoked autonomously (normal for skills) but it does not request permanent elevated platform presence. That limits blast radius if misconfigured.
Guidance
Key points to consider before installing/running: - Do not paste your wallet private key into UIs or store it in plain text unless you understand the risk. The skill asks you to set WALLET_PRIVATE_KEY as an environment variable for live trading — this is functional but risky. Prefer a remote signer or hardware wallet if possible, or at minimum keep the key in a secure secret store with tight access controls. - Metadata mismatch: the registry summary omitted required env vars, and clawhub.json only lists SIMMER_API_KEY. Confirm with the author whether WALLET_PRIVATE_KEY (or another signing mechanism) is required and how the simmer-sdk uses it. - Start in dry-run mode and verify behavior (python fastloop_trader.py) before enabling --live or scheduling cron jobs. Test with small amounts and the Daily Budget / max_position limits. - Review the simmer-sdk package and the fastloop_trader.py source yourself (or with someone you trust) to confirm there is no hidden exfiltration of secrets; network calls in code are to Binance/CoinGecko/Polymarket CLOB and the Simmer API which align with the stated purpose. - Ask the author to update metadata to declare all required env vars (including any wallet/private-key env), and to provide secure-signing alternatives and explicit guidance about how the SDK uses the private key. If you cannot confirm how the private key is handled, treat this skill as high-risk for live use and keep it to dry-run/testing only.
Latest Release
v1.3.4
- Added prominent warning that Simmer's stop-loss/take-profit risk monitor does not function on 5m or 15m fast markets. - Clarified that automated risk settings from the Simmer dashboard are ignored for fast market trades; sizing should be done manually. - Incremented metadata version to 1.3.4.
More by @adlai88
Published by @adlai88 on ClawHub
