Use when user asks about Polymarket prediction market via Decker. Triggers: Polymarket, 폴리마켓, 예측시장, PM 매수, PM 시장 검색, PM 카테고리, PM 이벤트, 시장 slug, YES/NO.

This skill appears to implement Decker↔Polymarket trading but it has important inconsistencies and insecure guidance you should consider before installing: - The SKILL.md references OPENCLAW_SECRET (sent in a GET URL) but the skill manifest lists no required credentials — ask the author to explicitly declare required secrets and explain how they are protected. - The instructions tell users to export their MetaMask private key and put it into Decker settings. Exporting raw private keys is risky. Prefer integrations that use WalletConnect, a hosted signer with clear security controls, or hardware wallets; never paste private keys into third-party services unless you fully trust and have audited them. - Embedding secrets in a GET query string leaks them to logs and intermediaries. Request that the developer switch to POST with secrets in request body or better: use authenticated headers and avoid including secrets in URLs. - Verify Decker's trustworthiness and how it stores keys (encryption at rest, access controls, key usage audit logs). If possible, test with a separate wallet holding minimal funds first. - Ask the publisher for: (1) explicit list of required env vars/credentials in the manifest, (2) explanation of how secrets are transmitted/stored, and (3) safer usage patterns (no secret-in-URL, recommend non-export signing flows). Because of these unresolved issues, treat the skill with caution until the developer provides clarification and improves secret handling.

Type: OpenClaw Skill Name: decker-polymarket Version: 1.1.0 The skill facilitates Polymarket trading via the Decker platform but explicitly instructs users to export their Polygon wallet private keys and provide them to the third-party service (api.decker-ai.com). While this is a common (though highly insecure) pattern for some crypto-trading bots, it represents a severe security risk for credential theft. Additionally, the SKILL.md documentation shows the 'openclaw_secret' being passed as a query parameter in a GET request to the external API, which is a poor security practice that could lead to secret exposure.