Polymarket Auto-Trader

Autonomous Polymarket prediction market trading agent. Scans markets, evaluates probabilities with LLM, sizes positions with Kelly criterion, and executes trades via CLOB API. Use when user wants to trade on Polymarket, set up automated prediction market trading, or build a trading bot. Supports cron-based autonomous operation, P&L tracking, and budget management.

This package appears to do what it says (an autonomous Polymarket trader), but it requires your wallet private key — which if leaked or misused will allow theft of funds. Before installing or running: 1) Create and use a dedicated, funded-with-minimum wallet (do not use your main wallet). 2) Review the contract addresses in references/contract-addresses.md to confirm they are legitimate. 3) Consider alternatives to storing the raw PRIVATE_KEY in plaintext (use a hardware signer or a secure key manager if possible). 4) Test on very small amounts ($5–$10) and monitor cron logs and P&L outputs closely. 5) Understand and accept the risk of approving MAX_UINT allowances (these grant broad spending rights to the contracts). 6) Verify the py-clob-client and web3 package versions and source (PyPI) and inspect create_or_derive_api_creds behavior if you care where derived credentials are stored. 7) If you want less exposure, modify scripts to use a signing service or ephemeral keys and to avoid storing private keys on disk. If you are not comfortable with these steps or with running code that can move funds, do not install or run this skill.

Type: OpenClaw Skill Name: polymarket-auto-trader Version: 1.0.1 The skill bundle sets up an autonomous trading bot that handles a blockchain private key and grants unlimited token spending approvals (MAX_UINT) to Polymarket contracts. While these high-risk actions (storing a private key in `.env`, broad token approvals, cron-based persistence, external LLM API calls) are transparently disclosed in `SKILL.md` and appear to be for the stated purpose of autonomous trading with legitimate services (Polymarket, Anthropic), the inherent vulnerabilities are significant. There is no evidence of intentional malicious behavior like unauthorized data exfiltration or covert backdoors, but the critical nature of the private key handling and unlimited approvals warrants a 'suspicious' classification due to the high potential for financial loss if the environment is compromised or the target contracts have vulnerabilities.