Weather Trader

Weather temperature prediction market trading on Polymarket via Simmer SDK. Uses NOAA (US) and Open-Meteo ensemble (international) forecasts as signal, EV/Ke...

This package appears to be a genuine weather-market trading bot, but several inconsistencies should make you cautious: - Do not run with --live or provide API keys until you verify the code. The skill will make authenticated network calls to Simmer (and may interact with Polymarket) and can execute real trades. - The registry metadata incorrectly states there are no required environment variables; the repository (clawhub.json and scripts/status.py) expects SIMMER_API_KEY and SKILL.md expects TRADING_VENUE in a .env. Confirm which credentials are required and where they will be used before supplying secrets. - There is no explicit install spec even though clawhub.json lists a pip dependency (simmer-sdk). Expect to install external Python packages if you run the code; review the package(s) (simmer-sdk) separately for trustworthiness. - Inspect weather_trader.py (the long entrypoint) and any modules that call external APIs to confirm there are no unexpected endpoints or credential exfiltration. Check how Polymarket live mode is implemented and whether it requires additional tokens or wallet signing. - Run the code first in dry-run mode and with network blocked (or against a sandboxed / test account) to observe behavior and file writes (trades.jsonl, performance_snapshot.json) before connecting real funds. If you want, I can: (a) list all places in the code that read environment variables or make network calls, (b) search weather_trader.py for lines that perform live trades or call external endpoints, or (c) highlight exactly which files/lines reference SIMMER_API_KEY and TRADING_VENUE.

Type: OpenClaw Skill Name: yh-polymarket-weather-trader Version: 1.16.0 The skill bundle is designed for weather-based trading on Polymarket but contains logic that violates skill isolation and performs non-standard file operations. Specifically, 'trade_performance.py' and 'weather_trader.py' attempt to access files and modules in parent and sibling directories ('Path(__file__).parent.parent'), which allows the skill to read data (such as 'trades.jsonl') from other installed skills. Additionally, 'weather_trader.py' writes detailed trade logs to a hidden directory in the user's home folder ('~/.hermes/'), which is an unusual and potentially stealthy location for data persistence. While these features are presented as 'Smart Money' signal integration and cross-skill reporting, the intentional directory traversal and out-of-sandbox file writing constitute significant security risks in an agentic environment.