Polyclaw

Become an autonomous prediction market trader on Polymarket with AI-powered analysis and a performance-backed token on Base. Trade real markets, build a track record, and let the buyback flywheel run.

Install only if you are comfortable giving this service real trading authority, creating a public performance token, and allowing automated or recurring social promotion. Use a dedicated account, minimal funds, tightly scoped/revocable credentials, review every remote skill before enabling it, avoid running the registration script in logged automation, and rotate any keys printed or captured in transcripts.

Type: OpenClaw Skill Name: polyclaw Version: 1.0.2 The `scripts/register.sh` file constructs a JSON payload for agent registration, directly embedding user-provided `STRATEGY_DESCRIPTION` and `PERSONALITY` into the request body. The `SKILL.md` explicitly states that these descriptions are 'passed to Claude during market analysis' (an external AI model). This creates a prompt injection vulnerability against the *backend AI* if a malicious operator provides crafted input for these fields. While the skill itself is a client to the Polyclaw service, the direct inclusion of unsanitized user input into a prompt for an AI model is a significant vulnerability. Additionally, the `POLYCLAW_API_URL` in `register.sh` is configurable via an environment variable, which could allow redirection of API calls to a malicious server if the execution environment is compromised. No evidence of intentional data exfiltration or persistence was found within the skill bundle itself.