庄家异动探测器

实时监控 Polymarket 大额资金异动，分析庄家持仓与胜率，支持 SkillPay 0.01U 支付保障情报价值。

This skill largely does what it says (polls Polymarket, charges via SkillPay) but I found a hardcoded SkillPay API key in the source. Before installing: (1) Treat the embedded key as a red flag — it may route payments or indicate a leaked secret. Ask the author whether that token is a harmless test key; if not, do not use it. (2) Prefer running the skill only after you set your own SKILLPAY_API_KEY environment variable; inspect/replace the hardcoded default in main.py. (3) Confirm who will receive the 0.01 USDT payments (the skill owner? you?). (4) Because the skill opens a networked API, run it in an isolated environment or sandbox until you verify behavior. (5) The registry metadata and skill.yaml disagree about required env vars; ask the publisher to correct this and to remove any embedded credentials. If the author confirms the embedded key is invalid/test-only and they update the repo to remove it, my concern would be reduced.

Type: OpenClaw Skill Name: poly-hunter-stable Version: 1.4.0 The skill implements a Polymarket price tracker with a mandatory cryptocurrency paywall via SkillPay. It is classified as suspicious primarily due to a hardcoded API key (sk_8b36c2ca9e774eb0243752f907b086e78c8af866a4088d3e3475113ed446b71) in main.py, which is a significant security vulnerability. Additionally, the code uses synchronous time.sleep within a loop in the FastAPI /invoke endpoint, which can block the event loop and lead to denial-of-service conditions under load.