Simmer Weather Trader

Automated weather prediction market trading skill for Simmer/Polymarket. Cross-references 4 weather sources (NOAA, Open-Meteo, Wunderground, NVIDIA FourcastN...

This skill appears to implement the trading functionality it claims, but several inconsistencies are concerning and should be resolved before installing or granting keys. Key points to check before use: - Dry-run gating: The README/SKILL.md state the bot defaults to dry-run and requires --live for real trades, but I could not find CLI parsing or a --live check in the visible code and execute_trade directly calls the Simmer trade endpoint. Ask the author for the exact mechanism that prevents live trades by default; do not provide a live trading key until you confirm a working dry-run switch. - TELEGRAM_BOT_TOKEN mismatch: SKILL.md marks Telegram token optional, but config.py unconditionally reads TELEGRAM_BOT_TOKEN (will raise an exception if absent). If you don't want Telegram, request a code change to make that env truly optional or provide a dummy token in a safe test environment. - Dependencies mismatch: clawhub.json, SKILL.md and requirements.txt disagree on which Python packages are required (numpy, netCDF4, simmer-sdk appear in some manifests but not others). Ensure the install process you run installs the exact packages required (netCDF4, numpy, Playwright + browser). Test in an isolated environment (container/VM) before pointing real keys at it. - Scheduled runs: The registry metadata includes a cron schedule (every 30 minutes). If you install this as a managed automaton, it may run automatically on that schedule. Combined with the dry-run uncertainty, that could lead to unintended live trades. Consider disabling scheduled/autonomous execution until you have confirmed the dry-run behavior. - Keys and permissions: The bot needs your SIMMER API key (used to place trades) and NVIDIA API key (FourcastNet). Only provide API keys with tightly scoped permissions and in a separate test account if possible. Rotate or revoke keys after testing. - Operational impacts: The bot uses Playwright to scrape Wunderground which is resource intensive and may run into anti-bot / rate-limit measures; it writes temp netCDF files when parsing FourcastNet outputs (files are deleted but running on shared hosts may cause issues). Logs are written to bot.log. If the author can demonstrate (or you can confirm) the following, my confidence would move to high/benign: a visible safe dry-run implementation that blocks execute_trade unless --live is passed or a clear env toggles live mode; corrected dependency manifests; and config.py changed to make TELEGRAM_BOT_TOKEN truly optional. Otherwise treat this skill as suspicious and run only in an isolated test environment with non-production API keys.

Type: OpenClaw Skill Name: simmer-weather-trader Version: 1.0.0 The skill implements an automated weather trading bot with several high-risk capabilities, including financial transaction execution via the Simmer SDK, web scraping using a headless browser (Playwright) in 'wunderground.py', and the downloading/parsing of binary ZIP/netCDF data from external NVIDIA APIs in 'ai_analyzer.py'. While these behaviors are aligned with the stated purpose of a multi-source weather trading bot, the combination of automated trading, scraping, and binary data processing—alongside the requirement for multiple sensitive API keys—meets the threshold for 'suspicious' as defined by the presence of risky capabilities without clear malicious intent.