What the reviewer found

Wallet-setup skill for Simmer/Polymarket recommends piping `curl -fsSL https://docs.openwallet.sh/install.sh | bash` to install a third-party "Open Wallet Standard" key vault that will hold the user's WALLET_PRIVATE_KEY — a remote-code install from a domain unaffiliated with this project, in a private-key-handling context. The `printenv SIMMER_API_KEY | cut -c1-20` line is a harmless local debug tip, not harvesting.

• remote-exec — runs code fetched from the network
• credential-access — reads credentials
• network — calls the vendor’s API

What was read

The file as it ships in SpartanLabsXyz/simmer-sdk:

• mcp/bundled-skills/simmer-wallet-setup/SKILL.md

What the static scan said

The scan flagged 3things. The reviewer kept 2 and dismissed 1 as false.

• E2Harvests environment variables — false positive
• SC2Downloads and executes remote code — real
• NETMakes network calls — real

How this review was made

Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.

Produced by agentmods.dev · Sonnet 5 · 7 September 2026