Polymarket Fast Loop

Trade Polymarket BTC 5-minute and 15-minute fast markets using CEX price momentum signals via Simmer API. Default signal is Binance BTC/USDT klines. Use when...

This skill appears to do what it says: it needs your Simmer API key and will execute trades only if you run it with --live. Before enabling live trading: (1) keep the key limited to the minimal permissions Simmer supports, (2) run extensive dry-runs and review config.json in the skill folder, (3) consider running in an isolated environment (container/VM) and using a small test balance, (4) be aware the code will read optional SIMMER_SPRINT_* env vars if set, and (5) note there is no homepage and metadata owner IDs differ between registry and _meta.json—verify the source/author if provenance matters to you.

Type: OpenClaw Skill Name: polymarket-fast-loop-1-0-6 Version: 0.1.0 The skill is classified as suspicious primarily due to the prompt injection risk present in `SKILL.md`. The markdown explicitly instructs the OpenClaw agent to set up cron jobs or heartbeat entries that execute shell commands (`cd /path/to/skill && python fastloop_trader.py --live --quiet`). While these commands are intended to run the skill itself for its stated purpose of automated real-money trading, this direct instruction to execute shell commands via markdown is a significant vulnerability in the agent's execution model. If the agent blindly follows such instructions, it could be exploited by a truly malicious skill. Additionally, the skill performs automated real-money trading on Polymarket, which is a high-risk activity, even though it is the stated purpose and requires an explicit `--live` flag. The `fastloop_trader.py` script itself does not contain overtly malicious code, but its functionality, combined with the prompt injection vector in `SKILL.md`, warrants a 'suspicious' classification.