Polymarket Edge

Trade and analyse Polymarket prediction markets with a 5-minute BTC EMA crossover strategy. Browse markets, read order books, run signals, manage a live auto...

Key things to check before installing or running: - Billing API key default: billing.py contains a hardcoded SKILL_BILLING_API_KEY and SKILL_ID fallback. This means if you don't set SKILL_BILLING_API_KEY in your environment the skill will use that embedded key, which could cause calls to be billed to the author's/account associated with that key. Always set SKILL_BILLING_API_KEY and SKILL_ID to your own values before running. - Wallet private key risk: live trading requires POLYMARKET_PRIVATE_KEY. Do NOT use any real or funded wallet; follow the README warning and only use a burner wallet. Prefer to leave auto_trade disabled unless you fully trust and audit the trading code and the signing integration. - Network calls & billing: the service makes outbound requests to skillpay.me, gamma-api.polymarket.com and clob.polymarket.com. Expect network traffic and remote billing/accounting; don't run on a system with secrets you don't want accessible to processes that can make outbound HTTP requests. - Live trading is not enabled by default: place_limit_order/place_market_order raise NotImplementedError until you integrate py-clob-client and supply a private key; this reduces immediate risk of accidental live trades, but you must still be careful when enabling. - Code review recommended: the code is largely coherent with its purpose, but because of the embedded billing key and the financial nature of the skill, review and replace the hardcoded API key, verify the SKILL_ID, and audit any modifications before exposing the service to other users or production traffic.

Type: OpenClaw Skill Name: polymarket-edge Version: 1.0.0 The skill is classified as suspicious due to its inherent capability to handle and potentially use a highly sensitive `POLYMARKET_PRIVATE_KEY` for live financial transactions. While the code includes strong warnings to use a burner wallet and explicitly disables live trading by default (requiring manual code modification to enable), the presence of this functionality and the handling of such a critical credential warrant a 'suspicious' classification. There is no evidence of intentional malicious behavior, data exfiltration beyond its stated purpose, or prompt injection attempts in the `SKILL.md` or `README.md`.