PolyEdge - Polymarket Correlation Analyzer

Detect mispriced correlations between Polymarket prediction markets. Cross-market arbitrage finder for AI agents.

High-level points to consider before installing or running this skill: - Purpose and behavior: The code implements a Polymarket correlation analyzer and an optional paid HTTP API (x402) as described. Running analyzer.py locally to inspect two markets is low-risk aside from normal network calls to Polymarket's API. - Default payment recipient: If you run the API server or deploy the provided docker-compose, the code's default PAYMENT_WALLET is hardcoded to an external address. Unless you explicitly set PAYMENT_WALLET to your own address via environment variables, payments will go to the author's wallet. This is not secret exfiltration but is a monetization choice you should be aware of. - Undeclared env vars: The SKILL.md / registry metadata say “no required env vars,” but the code reads env vars (PAYMENT_WALLET, PRICE_USDC, BASESCAN_API_KEY, BASE_RPC, REQUIRE_PAYMENT). If you intend to host the service, set these deliberately and inspect defaults. - Network behavior: The skill makes outbound requests to Polymarket (gamma-api.polymarket.com), BaseScan, and multiple public Base RPC providers. If you are in a restricted environment, be aware of these external calls. The x402 payment verification uses multiple third-party RPC endpoints as fallbacks — review those endpoints if you expect to control network endpoints. - Audit before deploying publicly: If you plan to host the API or expose it to agents, do a quick code audit: verify the PAYMENT_WALLET is set to your address (or remove payment logic if you don't want payg behavior), confirm BASESCAN_KEY usage and rate limits, and test the payment verification logic to ensure it matches your security/financial expectations (e.g., re-check minimal amount/slippage tolerance, on-chain verification robustness). - When to avoid: Do not give this skill any private keys or credentials. If you are not comfortable with the default payment wallet or with an external pay-to endpoint (api.nshrt.com referenced in docs), do not run the API server; instead run analyzer.py locally for one-off analyses. If you want, I can: (1) point out the exact lines where PAYMENT_WALLET is set and used, (2) produce a minimal checklist of env vars to set before deploying, or (3) summarize how the x402 verification works step-by-step.

Type: OpenClaw Skill Name: polyedge Version: 0.1.1 The skill bundle provides a Polymarket correlation analyzer, which can be run locally or accessed via a paid API. All external network calls (Polymarket API, Basescan API, Base RPCs) are directly related to fetching market data and verifying payments for the API service, as seen in `src/polymarket.py`, `src/dashboard.py`, and `src/x402.py`. Configuration is handled via environment variables (`os.environ.get`), which is standard practice and does not indicate exfiltration of unrelated sensitive data. The `SKILL.md` and `PLAN.md` documents contain no prompt injection attempts or instructions for the AI agent to perform unauthorized actions; `PLAN.md` even explicitly outlines several security best practices.