polymarket-weather-trader

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to ask for the Simmer API key and the wallet private key and to store/export them (including example export commands), which requires the LLM to receive and potentially echo secret values verbatim.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to execute live trades: it integrates with the Simmer Markets API (auth via SIMMER_API_KEY), requires a WALLET_PRIVATE_KEY to sign orders client-side, provides CLI flags to run in --live mode that "Execute real trades", and shows concrete buy/sell actions and position sizing. These are specific financial execution capabilities (sending transactions / placing market orders), not generic tooling.