Polymarket Trading Bot

Autonomous prediction market agent - analyzes markets, researches news, and identifies trading opportunities

This package appears to do what it claims, but it requires a wallet private key and can execute real trades — treat it as high-risk. Before installing or entering secrets: - Review the included code (configure.py, trade.py) yourself or with someone you trust. configure.py stores the private key in Clawdbot config; confirm you are comfortable with that storage location. - Prefer using a dedicated trading wallet with limited funds or a restricted API/subkey rather than your main wallet. - Inspect the py-clob-client library (and its create_or_derive_api_creds behavior) to understand what is sent to https://clob.polymarket.com and whether it exposes your private key remotely. - Test in a sandbox or with a read-only setup first (do not enable autonomous mode until you are confident). - Keep your environment variable (POLYMARKET_KEY) secured; if you prefer not to persist the key in Clawdbot config, set POLYMARKET_KEY only in the environment at runtime. - Verify dependencies are installed from official PyPI and consider auditing them (py-clob-client, web3, questionary, etc.). If you want, I can list exact lines where the skill stores secrets and where it initiates network calls to help a focused code audit.

Type: OpenClaw Skill Name: polymarket-trading-bot Version: 1.0.0 The skill is a functional Polymarket trading bot that handles sensitive Polygon private keys and supports autonomous financial transactions. While the code appears to align with its stated purpose, it possesses high-risk capabilities, specifically the collection and storage of a wallet private key via `configure.py` and instructions in `SKILL.md` for the AI agent to execute trades autonomously. It uses `subprocess` calls in `cli.py` to manage configurations and execute trades through `trade.py`, which interacts with the official Polymarket CLOB API (clob.polymarket.com). The inherent risk of private key exposure and unauthorized financial activity by an AI agent warrants a suspicious classification despite the lack of clear evidence of intentional malice.