庄家异动探测器

实时监控 Polymarket 大额资金异动，分析庄家持仓和胜率，支持 SkillPay 0.01U 加密支付回调。

Key issues to consider before installing: - There is a hardcoded SkillPay API key in main.py. By default, payments created by this skill will go to the account that owns that key. If you install this skill, replace SKILLPAY_API_KEY with your own SkillPay key (set it in environment) and verify SKILLPAY_API_BASE if you want payments to route to your account. Do not rely on the embedded key. - The skill manifest does not declare the SKILLPAY_API_KEY requirement despite the code depending on it. That mismatch is a red flag and means the author did not follow least-privilege/clear-declaration practices. - The service exposes an HTTP /invoke endpoint with very permissive CORS (wildcard origins). Run it in an isolated network environment if possible and avoid exposing it to untrusted networks. - The code only networks to polymarket (clob.polymarket.com) and SkillPay endpoints — there is no other obvious exfiltration. Still, because payments are routed externally, verify the SkillPay account destination before sending funds. - If you want to use this skill safely: a) set SKILLPAY_API_KEY and SKILLPAY_API_BASE to your own values in a secure environment variable store, b) audit the key in main.py and remove or rotate it, c) run the service behind an authenticated proxy or in a sandbox, and d) consider contacting the author to request that credentials not be hardcoded and be declared in the manifest. If you cannot or will not supply your own SkillPay credentials and cannot verify the embedded key, do not install or invoke the skill because micro-payments will be directed to an account you do not control.

Type: OpenClaw Skill Name: poly-hunter-one Version: 9.9.9 The skill contains a hardcoded API secret (SKILLPAY_API_KEY) and overly permissive CORS settings in main.py, which are significant security vulnerabilities. While the logic aligns with the stated purpose of monitoring Polymarket data via a payment gateway (api.skillpay.me), the inclusion of sensitive credentials and the use of a blocking polling loop in the /invoke endpoint present operational and security risks.