Polymarket Opportunities Scanning

Scan Polymarket prediction markets for book arbitrage opportunities (overbooked/underbooked multi-outcome markets), generate a formatted report, and deliver...

What to check before installing or running this skill: - Delivery mismatch: SKILL.md claims Telegram + email delivery, but send-report.js only sends email via Apple Mail (osascript). If you expect Telegram messages, the code does not implement them — review and add a Telegram sender or confirm OpenClaw will handle Telegram separately. - Platform & runtime: The code requires Node.js v18+ (native fetch) and relies on macOS (osascript) for email. The skill metadata did not declare an OS or Node requirement — run it only on a macOS machine with Node 18+ or adapt the email sending method. - Environment variables: Create a .env with SMTP_TO (recipient) as documented. TELEGRAM_CHAT_ID is mentioned in docs but not used by the script; verify whether you need to configure Telegram elsewhere. Do not commit .env to version control. - Safety / network: The scanner only calls Polymarket's public Gamma API and writes a local opportunities.json. There are no obvious external exfiltration endpoints. The email is sent via your local Mail app (osascript), which operates locally and then sends via your configured mail account. - Injection risk: send-report.js builds an AppleScript and passes it to osascript via the shell; it applies escaping for backslashes, quotes, and single quotes before execSync. This reduces command-injection risk, but because event titles come from an external API, review escaping logic if you plan to modify message formatting or forwarding to other command-based senders. - Operational advice: Run the scanner in an isolated environment first (not on a production machine), verify outputs, and confirm the email behavior works as you expect. If you need Telegram delivery, either run the script under an environment where OpenClaw's message tool will send the message, or modify send-report.js to call the Telegram API or a safe bot library (and then declare the required credentials). If you want, I can: (1) point out exact lines to modify to add Telegram sending, (2) produce a variant that uses SMTP directly (instead of osascript) for cross-platform use, or (3) run a more detailed line-by-line coherence check on specific parts of the code.

Type: OpenClaw Skill Name: polymarket-opportunities-scanning Version: 1.0.0 The skill bundle is a legitimate tool for identifying arbitrage opportunities on Polymarket using its public Gamma API. The logic in `scripts/scanner.js` correctly calculates price deviations in multi-outcome markets, and `scripts/send-report.js` handles reporting via macOS Apple Mail (using `osascript`) as documented. No evidence of data exfiltration, malicious command execution, or harmful prompt injection was found; the scripts use standard Node.js functionality and follow the stated purpose.