Polymarket Oracle

Multi-strategy arbitrage and trading bot for Polymarket prediction markets. Scans ALL markets (crypto, politics, sports, economics, entertainment) for parity...

This package implements a real-money trading bot and needs your Polymarket API key/secret/passphrase — that part is expected. Key concerns: (1) The manifest metadata is inconsistent with the SKILL.md/code (metadata claims no env vars but the code requires credentials). (2) The docs both tell you NOT to store your WALLET_PRIVATE_KEY on the server and then provide a systemd example that embeds it into the service file/credentials file — do not follow that example. Best practices before installing: generate Polymarket API keys locally using your wallet private key, then provide only the API_KEY/SECRET/PASSPHRASE to the running bot; never put your wallet private key on the server or in systemd Environment lines. Run the bot in simulation mode first; review the full code yourself (or have a trusted reviewer) to confirm it only uses the API keys for trading and does not exfiltrate credentials. If you proceed, store credentials in a tightly permissioned EnvironmentFile (chmod 600 root:root), avoid embedding secrets in unit files, and consider running within an isolated VM/container with restricted network access and monitoring. If you want greater assurance, ask the author to fix the manifest (declare required env vars and remove contradictory examples) and to remove any examples that recommend embedding private keys in service units.

Type: OpenClaw Skill Name: polymarket-oracle Version: 1.0.1 The Python code (`polymarket_oracle.py`) itself appears benign, adhering to declared network behaviors and not using the `WALLET_PRIVATE_KEY` at runtime for trading, despite reading it from environment variables. However, the documentation contains a critical vulnerability: `README.md` and `SYSTEMD_SETUP.md` explicitly instruct users to set `WALLET_PRIVATE_KEY` as an environment variable on the server, directly contradicting the strong security warnings in `SKILL.md` and `CONFIGURATION.md` that state it's 'ONLY for initial API key creation, not runtime'. This inconsistency could lead users to unnecessarily expose their wallet private key on the server, creating a significant security risk if the server is compromised.