Polymarket Bot

Polymarket 5-minute crypto UP/DOWN market automated trading bot. AI-powered prediction using Binance technical analysis (Position, Momentum, RSI, Volume), au...

Do not run this code unmodified. Specific actions to consider before installing or executing: - Replace the hardcoded Telegram token/chat ID with your own or remove remote notifications; treat the included token as a secret already compromised and avoid sending sensitive info to it. - Inspect (or obtain) the ai_trader package/modules that the scripts import via the absolute sys.path; do not let the skill import unknown code from outside the bundle. Prefer bundling dependencies or explicitly pointing to vetted modules. - Remove eval() usage on API-returned strings and replace with safe JSON parsing to avoid remote code execution risks. - Understand the Polymarket CLI/gnosis-safe wallet setup: the bot will invoke the CLI and can place orders using your wallet. Only run after you confirm the CLI uses the wallet you intend, ideally in a limited/simulated environment first. - Avoid running as root. Adjust file paths (logs/state) to a directory you control and verify file permissions. - If you want to use the notification feature, create your own Telegram bot/token and configure it via environment variables or a config file rather than editing scripts with hardcoded secrets. - Consider running in an isolated environment (VM/container) and perform code review of any external modules (ai_trader.*) before giving the bot access to real funds. If you want, I can: highlight the exact lines to change to remove hardcoded tokens, show how to replace eval() with safe parsing, or list a minimal checklist to sandbox and test the bot safely.

Type: OpenClaw Skill Name: polymarket-5m-bot Version: 3.1.0 The bundle contains a Polymarket trading bot with significant security vulnerabilities and hardcoded credentials. Most notably, `auto_bot_v2.py` uses `eval()` on data fetched from an external API to parse token IDs, creating a Remote Code Execution (RCE) risk. Additionally, `monitor_bets.py` and `position_monitor.py` contain hardcoded Telegram Bot API tokens (8315083265:AAGM_rUxfOzmnTDYd6v2n6n-kEArK37tKKk) and Chat IDs (1609325006), which is a major security flaw that exposes the bot's communication channel. While the code's logic is consistent with its stated purpose of automated trading, these critical flaws and the use of subprocesses to manage a financial wallet make the bundle high-risk.