polymarket-combo-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited polymarket-combo-builder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Place a real Polymarket combo (parlay): bundle 2+ binary legs into one YES/NO position, settled by a single signed RFQ order on Polymarket's combo exchange. Polymarket quotes the combined odds live; you sign once; if every leg hits you win the combined payout, and if any single leg loses you lose the whole stake.
This is the atomic combo — distinct from the leg-by-leg polymarket-worldcup-parlay-roller. Live placement works with EOA / self-custody wallets, and with deposit wallets after a one-time activate_combo_dw() setup (details below).
Read DISCLAIMER.md before going live. This is a framework, not an edge, and it runs in dry-run by default. Dry-run is a local plan — it resolves legs and shows the combined-odds estimate but signs and sends nothing. There is no paper / simulated-fill mode for combos (they're Polymarket-only). Note: dry-run still reads your wallet key to resolve trading identity, but it never signs or sends.
Polymarket venue only. Combos are a BETA Polymarket product (sports markets today); label them as such to users.
A combo's combined price is the makers' quoted probability that all legs hit. Example: three legs near 0.50 each quote around a 0.12–0.15 combined price, i.e. a ~7–8x payout multiple on the stake. The quote you sign already bakes in maker spread — it is not a naive product of the leg prices (the skill shows that product only as a pre-quote preview).
Agent: do this once with the user.
goals AND Argentina to win."
combo-markets feed — simmer_sdk.combo.fetch_combo_legs(). Each leg exposes position_ids = [YES_token, NO_token]; store the chosen side's token id. Moneyline, spread (-spread-), and total/over-under (-total-) legs are all eligible.
and the total-loss-if-any-leg-loses risk.
combo_config.json from combo_config.example.json (>= 2 legs).python combo_builder.py # dry-run: resolve legs, show estimate + plan, place nothing
python combo_builder.py --live # place the combo for real (money path)
python combo_builder.py --legs # browse combo-eligible legs (no config needed)Dry-run opens no socket, signs nothing, and moves no money. --live requires a configured wallet (WALLET_PRIVATE_KEY or OWS_WALLET) and a live Simmer client.
signature_type 0): standard self-custody key. Works today, noextra setup.
signature_type 3 / POLY_1271): **works after a one-timeactivate_combo_dw()** — see below.
OWS-signed deposit wallets can run the activate_combo_dw() setup headlessly with the same local OWS vault used for standard DW activation. Live combo order placement still requires the SDK's combo signing path to support that wallet type; if placement rejects your OWS setup, use a raw WALLET_PRIVATE_KEY for the wallet that owns the deposit wallet until OWS combo order signing is available.
Combos settle on a separate exchange that your wallet must approve first. The standard DW activation (activate_polymarket_dw()) does not set this — combo approval is opt-in. Run it once per deposit wallet:
# Wallet activation writes to a real-money wallet; opt in explicitly.
client = SimmerClient.from_env(venue="polymarket", live=True)
client.activate_combo_dw() # user-primary DW
client.activate_combo_dw(agent_id="…") # per-agent (Elite) DWThis signs the combo-exchange approval batch locally with your raw key or OWS vault, and Simmer's server relays it gaslessly under our builder credentials (it approves the combo exchange to spend the DW's pUSD + combo position tokens). It is idempotent — safe to re-run. After it completes, place_combo(..., dry_run=False) settles normally for supported deposit-wallet signers.
Before a live DW placement the SDK runs a quick on-chain pre-check and, if the combo approval is missing, raises a clear "run `client.activate_combo_dw()` first" error instead of letting the order fail at settlement. (Dry-run works for all wallet types with no activation.)
that window automatically, re-quoting if it lapses.
than its legs.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.