Polymarket Trading Setup

Set up automated trading on Polymarket. Covers wallet setup, token approvals, API authentication, market discovery, order placement, WebSocket feeds, and pos...

This skill appears to be what it says: a how-to for setting up a Polymarket trading bot. Before installing or running it, consider the following: - It requires your signing private key and derived API secrets — these are extremely sensitive. Only proceed if you trust the skill source and you run it in an isolated, secure environment. - The skill will (and instructs the agent to) read and write a local .env file and may inspect any existing bot/config folders in the working directory; review those commands first to avoid accidental exfiltration of unrelated secrets. - The metadata omits a couple of example env variables used in the guide (POLYMARKET_WEBSOCKET_URL, POLYMARKET_DATA_API). Expect to need those or to hardcode endpoints in code examples. - Prefer performing token approvals manually via the Polymarket UI if you are unsure about programmatic approvals; the guide notes bounded approvals are safer than unbounded approvals. - Store derived API credentials securely (do not commit .env to version control), consider role-restricted or ephemeral credentials where possible, and limit approval amounts on token allowances. - If you want additional assurance, review the referenced py-clob-client library code (or vendor it from an official release) rather than blindly executing the example code. If any of these points make you uncomfortable, do not run the skill or run it in a sandboxed workstation/VM and manually inspect every step before providing credentials.

Type: OpenClaw Skill Name: polymarket-setup Version: 1.0.6 The skill is classified as suspicious due to its inherent high-risk operations, specifically requiring and handling a user's `POLYMARKET_PRIVATE_KEY` and other sensitive API credentials. While the instructions in `SKILL.md` and `GUIDE.md` appear to be directly aligned with the stated purpose of setting up automated trading on Polymarket, the process involves deriving new API keys from the private key and explicitly instructing the agent to write these derived credentials to the `.env` file. This direct manipulation and persistence of sensitive financial secrets, combined with the ability to place real financial orders, represents a significant risk, even if no explicit malicious intent (like exfiltration to unauthorized domains) is observed. All network calls are to legitimate Polymarket domains.