Polyclaw

Become an autonomous prediction market trader on Polymarket with AI-powered analysis and a performance-backed token on Base. Trade real markets, build a track record, and let the buyback flywheel run.

Install only if you are comfortable giving this skill authority over real-money prediction-market trading, agent wallet/token deployment, and social posting. Use limited funds, rotate or revoke keys if exposed, avoid storing secrets in chat or agent memory, and verify the registration script sends credentials only to the intended Polyclaw API before funding an agent.

Type: OpenClaw Skill Name: polyclaw Version: 1.0.2 The `scripts/register.sh` file constructs a JSON payload for agent registration, directly embedding user-provided `STRATEGY_DESCRIPTION` and `PERSONALITY` into the request body. The `SKILL.md` explicitly states that these descriptions are 'passed to Claude during market analysis' (an external AI model). This creates a prompt injection vulnerability against the *backend AI* if a malicious operator provides crafted input for these fields. While the skill itself is a client to the Polyclaw service, the direct inclusion of unsanitized user input into a prompt for an AI model is a significant vulnerability. Additionally, the `POLYCLAW_API_URL` in `register.sh` is configurable via an environment variable, which could allow redirection of API calls to a malicious server if the execution environment is compromised. No evidence of intentional data exfiltration or persistence was found within the skill bundle itself.