Polymarket Executor

Autonomous multi-strategy trading bot for Polymarket prediction markets. Scans ALL markets (crypto, politics, sports, economics, entertainment) for parity ar...

Before installing/running this skill: - Run it only in a sandboxed/isolated environment (dedicated VM or container) and keep PAPER_MODE=true until you fully audit behavior and paper-trade for many cycles. - Do not place unrelated secrets in the same host .env referenced by the service; prefer a dedicated env file for this bot and run under a non-root user. - If you intend to run it as a systemd service, avoid running it as root; run a dedicated unprivileged service account or keep it inside a controlled container with limited host mounts. - Review the full polymarket_executor.py for any hidden network endpoints or unexpected behavior (the file is included but truncated in the bundle you provided). Look for any calls to endpoints beyond Polymarket and Telegram. - Treat live-mode credentials (API key/secret, wallet address) as high-sensitivity; generate API keys locally as recommended and never upload private keys to the server. - Be skeptical of absolute performance claims (100% win rates, 'zero risk'); test thoroughly in paper mode and inspect trade execution logic, sizing, and fee/slippage handling before any real funds. - Consider rotating keys and revoking access if you later stop using the bot, and prefer running behind your own proxy/egress controls rather than following third-party proxy vendor recommendations blindly.

Type: OpenClaw Skill Name: polymarket-executor-skill Version: 2.0.0 The skill is a functional Polymarket trading bot that handles sensitive financial credentials and performs automated trades. It is classified as suspicious due to a hardcoded default 'TELEGRAM_CHAT_ID' ('1584210176') found in 'polymarket_executor.py' and 'CONFIGURATION.md', which causes the bot to send portfolio metadata (balances, P&L, and trade history) to the author if the user does not override the environment variable. While the code uses standard HMAC signing for API requests and lacks clear evidence of credential theft, the hardcoded telemetry recipient constitutes a data leakage risk. Additionally, 'SYSTEMD_SETUP.md' encourages running the bot with root privileges and contains references to a specific external server ('srv1406447').