Polymarket Weather Bands

Autonomous Polymarket weather-market trading flow for AION Market agents. After the user provides AION API key and wallet private key, the agent should autom...

Key considerations before installing or using this skill: - The SKILL.md will ask you to provide your WALLET_PRIVATE_KEY and AIONMARKET_API_KEY. Never paste a high-value private key into a third-party skill unless you fully trust how it is used and transmitted. - The registry metadata claims no required env vars, but the runtime instructions contradict that — ask the publisher to resolve this mismatch and provide an explicit data-flow statement (what is signed locally vs what is transmitted to AION or Polymarket endpoints). - Confirm whether wallet registration only sends a derived public address or whether any secret/signed material (or raw private key) is uploaded. If the private key is transmitted or stored remotely, do not use it. - Prefer safer alternatives: use a dedicated low-value spending wallet, hardware wallet or remote signer (so the skill never sees the raw private key), require explicit user confirmation for any trade above a small threshold, and test first in sandbox with minimal funds. - If you still consider using it, request from the publisher: (1) exact API endpoints called for registration and what payloads they receive, (2) whether signing is local, (3) a promise not to persist private keys, and (4) an option to force manual confirmations for every on-chain action. - Because the metadata/manifest is inconsistent, exercise caution and seek clarification before supplying secrets. Additional information that would raise confidence: an explicit statement that signing is done locally with no private-key transmission, sample request/response examples, or source code showing local signing and only public data being sent.

Type: OpenClaw Skill Name: polymarket-weather-bands Version: 0.3.0 The skill requires the user to provide a 'WALLET_PRIVATE_KEY' and 'AIONMARKET_API_KEY', instructing the AI agent to automatically derive Polymarket CLOB credentials and register them with a third-party service (aionmarket.com). Furthermore, the instructions in 'skill.md' explicitly direct the agent to perform financial transactions, including token approvals and market trades, without seeking user confirmation. While these behaviors are consistent with the stated goal of an automated trading bot, the handling of raw private keys and the intentional bypass of human-in-the-loop confirmation for financial actions pose a high security risk.