← Back to Skills Marketplace
83
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install polymarket-predictradar-data-layer-skills
Description
Shared Polymarket and prediction-market data access layer. Use this skill whenever another skill or task needs trader positions, trade history, market metada...
Usage Guidance
This skill appears to implement the claimed Polymarket/PredicTradar data layer, but several implementation details are inconsistent with the declared metadata and introduce risk:
- The code expects/reads environment variables (MCP_URL, MCP_API_KEY) and proxy env vars even though the registry metadata lists no required env. If you set MCP_API_KEY, treat it as a secret and only provide it in a controlled environment.
- The skill runs local commands to detect proxies (scutil, python3 via execFileSync). If you run this on a machine where those binaries exist, they will be executed. Consider running in an isolated container if you are concerned.
- The gamma-client disables TLS certificate verification (rejectUnauthorized: false) when establishing TLS connections; this weakens transport security and can expose you to man-in-the-middle tampering of gamma-api.polymarket.com interactions.
- The skill writes cache files under scripts/cache and includes a warm-up script that performs many queries; expect disk usage and potentially heavy network/API usage. Review and control when/if init.js is run.
- The absence of declared env requirements is an inconsistency — ask the publisher (or inspect code) before supplying any credentials or exposing sensitive networks. If you decide to install, run it in a sandboxed environment, avoid supplying sensitive credentials unless necessary, and consider patching the TLS setting (enable certificate verification) and removing or restricting local exec calls if you cannot trust the runtime.
Capability Analysis
Type: OpenClaw Skill
Name: polymarket-predictradar-data-layer-skills
Version: 1.0.0
The skill bundle provides a sophisticated data access layer for Polymarket via an MCP server and the Gamma API. It is classified as suspicious due to several high-risk security vulnerabilities: `gamma-client.js` explicitly disables TLS certificate verification (`rejectUnauthorized: false`), which exposes the agent to Man-in-the-Middle (MitM) attacks. Additionally, `proxy-config.js` executes system-level commands (`scutil`) and spawns a `python3` process to detect proxy settings. While these implementations appear to be functional choices for handling network environments without external dependencies, they represent significant security flaws and invasive system interactions.
Capability Assessment
Purpose & Capability
The package implements a prediction-market data layer (mcp-client, queries, gamma-client, smartmoney) which matches the declared purpose. However the manifest declared 'required env vars: none' while the code reads MCP_URL and MCP_API_KEY (mcp-client.js) and also inspects HTTPS_PROXY/HTTP_PROXY (proxy-config.js). It executes platform tools (scutil, python3) to detect proxies even though no binaries were declared as required. These undeclared runtime dependencies and env var hooks are inconsistent with the skill metadata.
Instruction Scope
SKILL.md instructs usage of the MCP wrapper, which is consistent. But the included scripts do extra things beyond simple read-only requests: they create and manage local cache files under scripts/cache (cache.js), run a cache warm-up sequence that will perform many queries (init.js, daily-report.js), and detect system proxy settings by executing scutil and python3 (proxy-config.js). Those operations read/write local filesystem state and run local commands rather than only performing remote read-only API calls; the runtime instructions do not fully call these out.
Install Mechanism
There is no install spec (instruction-only), which reduces supply-chain risk. But the skill includes many code files that will run inside the agent environment; no build/install step is required and files will execute at runtime. That is coherent but means the skill will run Node code in the agent runtime with filesystem and network access.
Credentials
Code reads/uses environment variables not declared in the skill metadata: MCP_URL and MCP_API_KEY (mcp-client.js) and standard proxy env vars (HTTPS_PROXY/HTTP_PROXY) plus system proxy detection. MCP_API_KEY is a sensitive credential; the skill does not declare it as required or primary. The default MCP_API_KEY falls back to a public key string, but the ability to override via env means sensitive secrets could be provided — the skill does not document or request them explicitly in metadata.
Persistence & Privilege
The skill does not request always:true and does not alter other skills' configs. It writes cache files under scripts/cache and includes a warm-up script (init.js) that can create persistent cache artifacts and perform heavy querying. Writing cache to disk is expected for a data-layer but is persistent and can grow; this is legitimate but worth noting.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install polymarket-predictradar-data-layer-skills - After installation, invoke the skill by name or use
/polymarket-predictradar-data-layer-skills - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
- Initial release of the Polymarket data access layer, providing a unified interface for market and trader intelligence.
- Features automatic MCP session handshake and prioritizes the PredicTradar MCP Server as the primary data source, with fallbacks to polymarket-cli and Polymarket Data API.
- Exposes high-level tools for trader positions, detailed market data, trade history, leaderboards, and SQL-based analytics.
- Documents full MCP tool catalog, table schemas for `trades` and `positions`, and example usage patterns.
- Introduces convenience wrappers for key operations and details recommended environment variables.
- Provides example and helper scripts for integration and data exploration.
Metadata
Frequently Asked Questions
What is polymarket-predictradar-data-layer-skills?
Shared Polymarket and prediction-market data access layer. Use this skill whenever another skill or task needs trader positions, trade history, market metada... It is an AI Agent Skill for Claude Code / OpenClaw, with 83 downloads so far.
How do I install polymarket-predictradar-data-layer-skills?
Run "/install polymarket-predictradar-data-layer-skills" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is polymarket-predictradar-data-layer-skills free?
Yes, polymarket-predictradar-data-layer-skills is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does polymarket-predictradar-data-layer-skills support?
polymarket-predictradar-data-layer-skills is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created polymarket-predictradar-data-layer-skills?
It is built and maintained by Yeri (@cnica); the current version is v1.0.0.
More Skills