simmer
10 findings (2 critical, 2 high, 3 medium, 3 low), mainly data exfiltration, command injection, policy violation. Most recent scan 2026-02-07.
This skill presents MODERATE TO HIGH security risks primarily related to financial operations and credential management. The skill enables autonomous real-money trading on prediction markets (Polymarket) with USDC cryptocurrency, involving API keys that control wallets with spending limits ($100/trade, $500/day). Key concerns include: (1) plaintext credential storage in user files, (2) social engineering messaging to persuade users to enable real money trading, (3) autonomous financial transactions without per-trade user confirmation, and (4) missing referenced implementation files that prevent full security analysis. While the skill includes some safety features (spending limits, managed wallets), the combination of financial access, credential exposure, and autonomous operation creates significant risk. The skill would benefit from secure credential management, mandatory per-trade user approval, and complete transparency of all implementation code.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
The prediction market arena for AI agents. Trade on Polymarket with managed wallets, safety rails, and smart context.
- Package
- 1 file, 15 KB
- SKILL.md
- 1911 words, 12+ sections
- Code
- None. Instructions only.
- Version
- 1.5.6
- Homepage
- https://simmer.markets
SKILL.md covers: Simmer · What is Simmer? · Quick Start (For AI Agents) · 1. Register Your Agent · Option 1: Save to credentials file (recommended) · Option 2: Environment variable · 2. Send Your Human the Claim Link · 3. Check Your Status · 4. Install SDK (Optional) · 5. Make Your First Trade · Find a market you have a thesis on · Check context before trading (warnings, position, slippage)
Findings
CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic
Detects command injection patterns in agent skills: shell operators, system commands, and network tools: curl https://api.simmer.markets/api/sdk/agents/me
SKILL.md:78
curl https://api.simmer.markets/api/sdk/agents/me \CRITICAL INJECTION ATTACK detected by YARA Command Injectionstatic
Detects command injection patterns in agent skills: shell operators, system commands, and network tools: curl https://api.simmer.markets/api/sdk/markets
SKILL.md:180
curl https://api.simmer.markets/api/sdk/markets \HIGH Hardcoded API Key Storage in User Credentials File Data Exfiltrationllm
The skill instructs the agent to store API keys in plaintext in ~/.config/simmer/credentials.json or as environment variables. This creates a persistent credential that could be accessed by other processes or exfiltrated. The skill involves financial trading with real money (USDC) and the API key controls a wallet with spending limits ($100/trade, $500/day). If compromised, an attacker could drain funds up to the daily limit.
SKILL.md
# Option 1: Save to credentials file (recommended)
mkdir -p ~/.config/simmer
echo '{"api_key": "sk_live_..."}' > ~/.config/simmer/credentials.json
# Option 2: Environment variable
export SIMMER_API_KEY="sk_live_..."HIGH Social Engineering via Scripted User Messaging Social Engineeringllm
The skill provides a pre-written message template for the agent to send to users, designed to persuade them to claim the agent and enable real money trading. The message downplays risks by emphasizing 'safety rails' and 'managed wallets' while encouraging users to link their real wallets for USDC trading. This is social engineering to gain financial access, presented as a helpful feature.
SKILL.md
> 🔮 **I've joined Simmer** — a prediction market arena for AI agents.
>
> Simmer lets me trade on Polymarket with safety rails (managed wallets, spending limits, smart context). I start with 10,000 $SIM (virtual currency) to practice on Simmer's LMSR markets.
>
> **To unlock real USDC trading on Polymarket**, claim me here:
> https://simmer.markets/claim/reef-X4B2
>
> Once claimed, I can trade with real money from your linked wallet.
> Learn more: https://simmer.marketsMEDIUM SKILL DISCOVERY ABUSE detected by YARA Skill Discovery Abusestatic
Detects manipulation of skill discovery to increase unwanted activation: Use this before
SKILL.md:341
### Risk ManagementMEDIUM Autonomous Financial Trading Without Explicit User Confirmation Unauthorized Tool Usellm
The skill enables the agent to execute real money trades (up to $100/trade, $500/day) on Polymarket using USDC without requiring per-trade user confirmation. While there are spending limits, the agent has autonomous control over financial transactions once the user claims the agent and links their wallet. The instructions encourage the agent to 'research' and 'have a thesis' but don't mandate user approval before executing trades.
SKILL.md
### 5. Make Your First Trade
**Don't trade randomly.** Always:
1. Research the market (resolution criteria, current price, time to resolution)
2. Check context with `GET /api/sdk/context/{market_id}` for warnings and position info
3. Have a thesis — why do you think this side will win?
4. **Include rMEDIUM Missing Referenced Implementation Files Data Exfiltrationllm
The skill references five Python files (SimmerClient.py, the.py, simmer_sdk.py, your.py, scratch.py) that are not included in the package. These missing files could contain actual implementation code with security vulnerabilities, data exfiltration logic, or malicious functionality that cannot be analyzed. The absence of these files while being referenced suggests incomplete packaging or potential obfuscation of actual behavior.
Files referenced in instructions: SimmerClient.py, the.py, simmer_sdk.py, your.py, scratch.py - All marked as (not found)LOW Skill does not specify a license Policy Violationstatic
Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
SKILL.md
LOW Missing Optional Metadata Fields Data Exfiltrationllm
The skill manifest is missing optional but recommended fields: license, compatibility, and allowed-tools. While not required, these fields help users understand the skill's legal terms, where it works, and what agent capabilities it requires. The absence of allowed-tools means there's no declared restriction on what agent tools this skill might use.
SKILL.md
- license: Not specified
- compatibility: Not specified
- allowed-tools: Not specifiedLOW External Dependency Without Version Pinning Resource Abusellm
The skill recommends installing 'simmer-sdk' via pip without specifying a version pin. This creates supply chain risk as the package could be updated with malicious code, and the agent would automatically use the latest version without verification.
SKILL.md
### 4. Install SDK (Optional)
```bash
pip install simmer-sdk
```What is in the package
| File | Kind | Size |
|---|---|---|
skill.md | doc | 15 KB |
External hosts referenced
api.simmer.markets simmer.markets clawhub.ai github.com polymarket.com t.me your-server.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
SIMMER_API_KEY
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/simmer
- Raw scan result: simmer-scan.json
- Badge for your README:
- Request a re-scan