Polymarket Fast Loop

Trade Polymarket BTC 5-minute and 15-minute fast markets using CEX price momentum signals via Simmer API. Default signal is Binance BTC/USDT klines. Use when...

This skill is functionally coherent with trading Polymarket sprint markets, but it asks you to supply and store your wallet private key for live trades while the registry only declares an API key requirement — that's the main red flag. Before installing or using it live: (1) treat the wallet private key as highly sensitive — avoid placing it in environment variables on shared hosts or CI; prefer an isolated machine, a hardware wallet, or a signing service with minimal privileges; (2) run the script in dry-run mode extensively and review the simmer-sdk package and the skill code yourself (or in a sandbox) to confirm no unexpected network endpoints or exfil behaviors; (3) ask the maintainer to update the registry metadata to declare WALLET_PRIVATE_KEY (and any other required envs) so the requirement is explicit; (4) if you must run live, limit exposure by using a wallet with only the minimum USDC needed and rotate keys after tests; and (5) consider running this on an isolated VM/container with restricted network access until you're confident of its behavior.

Type: OpenClaw Skill Name: polymarketbot Version: 0.1.0 The skill is designed for automated crypto trading on Polymarket, which inherently involves high financial risk and the handling of sensitive credentials. The `SKILL.md` and `fastloop_trader.py` explicitly instruct the user and agent to store the `WALLET_PRIVATE_KEY` (for the Polymarket wallet holding USDC) as an environment variable. While this is necessary for the skill's stated purpose of client-side order signing, storing a private key in an environment variable is a significant security vulnerability. If the agent's execution environment is compromised, this key could be exposed, leading to unauthorized access to user funds. There is no evidence of intentional malicious behavior (e.g., exfiltration of the key to an unauthorized endpoint, backdoors, or malicious prompt injection), but the method of handling such a critical credential makes the skill suspicious due to the high-risk vulnerability it introduces.