polymarketz

Comprehensive Polymarket prediction market skill — browse trending markets, search events, check real-time odds & prices, view order books, analyze price his...

This skill appears to do what it claims: public read-only market queries plus optional trading using a local Polygon private key. Before enabling trading, review the scripts/polymarket.py wallet-setup and trade code: confirm whether the private key is stored encrypted or plaintext, check file permissions on ~/.config/polymarket/wallet.json, and inspect any network calls during trading to ensure keys/signatures are handled locally and not exfiltrated. If you prefer lower risk, use the read-only commands only (they require no keys), or create a dedicated wallet with minimal funds and gas for testing instead of using your main funds. If you want higher assurance, run the script in an isolated environment and read the full source to verify no hidden endpoints or telemetry are present.

Type: OpenClaw Skill Name: polymarketz Version: 1.0.0 The skill provides a CLI for Polymarket market analysis and trading, but it is classified as suspicious due to high-risk credential handling. The script `scripts/polymarket.py` includes a `wallet-setup` command that prompts users for a Polygon private key and stores it locally in `~/.config/polymarket/wallet.json`. While these capabilities (filesystem and network access) are plausibly needed for the stated purpose of a trading tool, and no evidence of exfiltration or malicious intent was found, the collection of sensitive private keys—especially within a script where the trading logic is currently implemented as non-functional placeholders—constitutes a significant security risk.