Polymarket Portfolio Tracker

Monitors Polymarket positions every 30 minutes, tracks P&L, sends Telegram alerts on wins, big moves, triggers auto-reinvestment, and enforces daily loss cir...

This skill contains working monitor code but several inconsistencies and risky behaviors you should consider before installing: - Sensitive credentials: The code uses PRIVATE_KEY (Polygon private key) and Telegram tokens at runtime. Do not provide your main private key unless you fully trust and audit the code. Prefer a watch-only wallet or an address without spending power for initial testing. - Registry metadata mismatch: The registry lists no required env vars, but SKILL.md and monitor.py expect PRIVATE_KEY, WALLET_ADDRESS, TELEGRAM_BOT_TOKEN, and TELEGRAM_CHAT_ID. Treat that as a red flag and ask the publisher to correct metadata before use. - Hardcoded wallet: monitor.py contains a hardcoded WALLET address (0xF0D1...). If you forget to set WALLET_ADDRESS, the skill will query that address by default — likely a third party's. Change it or set WALLET_ADDRESS explicitly. - Auto-reinvest and external scripts: The monitor will call auto_reinvest.py, weather_scanner.py, and exit_manager.py (not included). Those scripts could perform trades or withdraw/deploy funds. Do not run this skill with private keys on a machine you care about until you have reviewed or disabled the reinvest/exit calls. Run in read-only/dry-run mode first. - Third-party packages: Verify the Polymarket client package name and inspect that package (py_clob_client/polymarket-clob-client) before installing; ensure it is the official package. Changing package names or mismatches can lead to installing the wrong code. - Safe steps before use: (1) Audit the missing scripts or remove/disable run_script calls; (2) run the monitor with no PRIVATE_KEY to confirm read-only behavior; (3) run locally with a watch-only address and test Telegram alerts; (4) require the publisher to provide provenance (homepage/source) or include all auxiliary scripts. Given the missing metadata and the ability to redeploy funds, treat this skill as potentially dangerous until you can verify the auxiliary scripts and the Polymarket client code.

Type: OpenClaw Skill Name: polymarket-portfolio-tracker-v2 Version: 1.0.0 The bundle implements a Polymarket trading and monitoring bot but is classified as suspicious due to high-risk behaviors and missing components. Specifically, `monitor.py` handles sensitive `PRIVATE_KEY` environment variables and uses `subprocess.run` to execute external scripts (`auto_reinvest.py`, `weather_scanner.py`, `exit_manager.py`) that are not included in the bundle, making its full behavior unverifiable. Furthermore, there is a discrepancy between the documentation in `SKILL.md`, which promises Telegram alerts, and the actual code in `monitor.py`, which only prints alerts to standard output without any network calls to the Telegram API.