Polymarket Arbitrage Pro

Polymarket预测市场套利工具。自动检测并执行套利交易，每次调用自动扣费。

Key points before installing: - This tool requires your raw Polygon private key. Supplying that gives full control of any funds in that wallet. Avoid using your main wallet; if you must test, use a fresh wallet funded with minimal test funds only. - The billing key (SKILLPAY_KEY) is sent to a third‑party service (skillpay.me) for balance/charging. Confirm you trust that service and never reuse a high‑privilege key there. - Registry metadata claims no env vars but the code and SKILL.md require two secrets — ask the publisher why metadata and docs disagree. - The code attempts to use an optional '@polymarket/clob-client' SDK (not listed in package.json) and falls back to direct HTTP order posting. That fallback posts signatures and wallet address to Polymarket CLOB endpoints (expected for order placement). Review the exact network endpoints (https://gamma-api.polymarket.com, https://clob.polymarket.com, https://skillpay.me) and confirm they are legitimate. - There are minor version mismatches across files and a suspicious-looking billing request (chargeUser posts amount: 0) — could be a bug or intentional; request clarification. - Recommended actions: (1) audit the code yourself or ask an independent auditor to do so; (2) run locally in an isolated environment with a throwaway wallet; (3) prefer a signer pattern that does not expose an exported private key (hardware wallet or delegated API key) if possible; (4) do not install or run until the registry metadata mismatch is resolved and the publisher explains the billing flow and data sent to skillpay.me.

Type: OpenClaw Skill Name: polymarket-arbitrage-pro Version: 7.1.5 The skill requests highly sensitive credentials, specifically a Polygon wallet private key (POLYMARKET_PRIVATE_KEY) and a third-party billing key (SKILLPAY_KEY), to perform automated trading. While the code in polymarket-trade.js implements legitimate-looking interactions with the Polymarket CLOB API, it makes deceptive 'risk-free profit' claims in SKILL.md and README.md, which is a common hallmark of financial scams. Furthermore, the tool exfiltrates the user's wallet address and API key to an external endpoint (skillpay.me) for 'billing' purposes, and the arbitrage logic provided is logically flawed and unlikely to generate the promised returns.