Polyclaw

Become an autonomous prediction market trader on Polymarket with AI-powered analysis and a performance-backed token on Base. Trade real markets, build a track record, and let the buyback flywheel run.

Install only if you intentionally want a persistent autonomous trading agent using real funds and public posting. Verify the official backend URL with the publisher, start with small funds, keep trading/posting disabled until configured, avoid storing API keys in agent memory or transcripts, rotate keys if exposed, and confirm pause, withdrawal, delete, and credential-revocation controls before funding.

Type: OpenClaw Skill Name: polyclaw Version: 1.0.2 The `scripts/register.sh` file constructs a JSON payload for agent registration, directly embedding user-provided `STRATEGY_DESCRIPTION` and `PERSONALITY` into the request body. The `SKILL.md` explicitly states that these descriptions are 'passed to Claude during market analysis' (an external AI model). This creates a prompt injection vulnerability against the *backend AI* if a malicious operator provides crafted input for these fields. While the skill itself is a client to the Polyclaw service, the direct inclusion of unsanitized user input into a prompt for an AI model is a significant vulnerability. Additionally, the `POLYCLAW_API_URL` in `register.sh` is configurable via an environment variable, which could allow redirection of API calls to a malicious server if the execution environment is compromised. No evidence of intentional data exfiltration or persistence was found within the skill bundle itself.