Polymarket BTC Trader

Polymarket BTC 5分钟 Up/Down 全自动交易机器人。MiniMax AI 驱动，双信号决策，自动止盈止损，真实链上交易，Web控制面板。

Do not supply real Polymarket/private-key credentials until you verify the source and intended behavior. Specific items to check before installing or running: 1) The registry metadata claims no required env vars, but bot.py and status_server.py expect many secrets (POLYMARKET_API_KEY, POLYMARKET_API_SECRET, POLYMARKET_PRIVATE_KEY, RELAYER_API_KEY, AI API keys). That mismatch is suspicious — ask the publisher why metadata omitted them. 2) Inspect references/.env.example to see exactly which placeholders will be written to $WORK_DIR/.env by the startup scripts. 3) Run first in isolated environment (VM or disposable container) and use paper/simulated mode only (do not enable real account mode or provide a private key). 4) Audit how the web panel/status server handles .env and status files: ensure it does not expose raw secrets via HTTP endpoints. Note the code builds HMAC headers using POLYMARKET_API_SECRET and will sign requests if provided. 5) There are small deployment inconsistencies: SKILL.md / README reference panel port 18095 but status_server.py uses PORT = 18795, and panel_start.sh references a slightly different SKILL_DIR; verify and correct paths before deployment. 6) Prefer to keep only minimal credentials in the bot's .env (paper-mode API credentials or read-only keys where possible) and never put long-term private keys on unknown third-party code. 7) If you need higher confidence, request the maintainer identity, a signed release, or run a line-by-line audit (focus on bot.py and status_server.py) and ensure you understand where and when signing/transactions occur. If you can't verify provenance, treat the skill as untrusted and run only with simulated data.

Type: OpenClaw Skill Name: polymarket-btc-trader Version: 1.0.0 The skill bundle provides a functional Polymarket BTC trading bot that handles highly sensitive information, including private keys and API secrets. It is classified as suspicious due to significant indicators of poor code quality and potential security risks: 'status_server.py' contains hardcoded absolute file paths referencing a specific developer's home directory ('/home/billy'), and 'status.js' contains placeholder API keys for the 'Simmer' service using confusing 'sk_live' prefixes. Furthermore, there are discrepancies between the documentation and the code regarding the web panel's port (18095 vs 18795). While no explicit evidence of intentional data exfiltration or malicious backdoors was found, the combination of high-risk financial capabilities and unpolished code makes it a risky asset to execute.