Polymarket Arb Bot

Polymarket 5-minute crypto UP/DOWN market automated trading bot. AI-powered prediction using Binance technical analysis (Position, Momentum, RSI, Volume), au...

Key things to check before installing or running this skill: - Do not export or use private keys until you audit the repository. SKILL.md asks you to set POLYMARKET_PRIVATE_KEY / POLYMARKET_PROXY_ADDRESS; these are sensitive. Verify `wallet_backup.txt` does not contain any real private keys — treat it as compromised until proven otherwise and never reuse keys found in the repo. - The registry metadata underreports dependencies. The code uses node, puppeteer/playwright, openclaw CLI/browser tool, scrapling, and Python requirements. Follow the repo README and inspect requirements.txt and package.json; install deps in an isolated VM/container first. - Start with ENABLE_TRADING = False (or equivalent) and run in dry-run/simulated mode until you validate logic and network calls. Log all outgoing requests and subprocess calls during tests. - Search the repo for any plaintext secrets (API keys, private keys) and remove them. If `wallet_backup.txt` contains keys, assume they are compromised — do not fund those wallets. - Review any subprocess invocations (polymarket, node scripts, openclaw, playwright) and confirm you trust the binaries. Playwright downloads browsers and has nontrivial resource/attack surface; run in an isolated environment. - Consider using a hardware wallet / multisig (Gnosis Safe) with limited signing rights rather than placing private keys in environment variables or in source files. - If you plan to run with real funds: perform a security audit (dependency versions, network endpoints), run in a sandbox, and only use small amounts after testing. If you are not comfortable reviewing code or secrets, avoid running this skill with real wallets.

Type: OpenClaw Skill Name: polymarket-arb-bot Version: 3.3.5 The skill bundle contains a functional Polymarket trading bot with several high-risk security concerns. Most notably, 'wallet_backup.txt' contains a plaintext private key, and multiple scripts ('auto_bot_v3.py', 'position_monitor.py', 'monitor_bets.py') contain hardcoded Telegram Bot tokens and a specific Chat ID (1609325006). This configuration causes the bot to exfiltrate all trading activity, including positions and profits, to a third-party Telegram account. While these features are technically aligned with the bot's stated purpose of automated trading and notification, the hardcoded nature of the credentials and the inclusion of a private key in the bundle pose a severe security and privacy risk to users.