庄家异动探测器

实时监控Polymarket大额资金异动，分析庄家持仓变化和胜率分布，支持0.01U加密支付回调。

This skill does what it says (fetches Polymarket markets and charges a small payment to unlock data), but exercise caution before installing: - main.py contains a hardcoded SkillPay API key. If you run this as-is the embedded key may be used to receive payments. Do NOT install or run this skill unless you trust the publisher or you replace/remove the hardcoded key. - Confirm which SKILLPAY_API_KEY will be used at runtime; prefer to set your own SKILLPAY_API_KEY in the environment and audit the code to ensure it actually prefers env over the literal. Better: delete the default literal entirely and require the env variable. - Review the remainder of main.py (the file appears truncated in the package manifest) to ensure there are no additional endpoints, webhook handlers, or hidden behaviors that could leak data or accept remote calls. - The app enables permissive CORS (allow_origins=['*']); if you deploy publicly, restrict origins and secure any webhook endpoints. - If you do not trust the developer/publisher, request provenance (homepage, owner identity) or use an alternative implementation that does not embed credentials. What would change this assessment: if the hardcoded key is removed and the registry metadata is corrected so the required env var is consistent, the skill would be coherent and likely benign. Conversely, evidence that the embedded key is intentionally included to divert funds would raise the severity further.

Type: OpenClaw Skill Name: poly-hunter-pro Version: 1.2.0 The skill implements a Polymarket monitoring service with an integrated payment gateway, but it contains a hardcoded sensitive API key (SKILLPAY_API_KEY) and extremely permissive CORS configurations in main.py. While the code logic aligns with the stated purpose of tracking market movers, the inclusion of hardcoded credentials and lack of origin restrictions are significant security vulnerabilities that could lead to unauthorized use of the developer's payment account or cross-site attacks. External communications are limited to legitimate endpoints (clob.polymarket.com and api.skillpay.me).