Wangbo Polymarket Copytrading

Build and run Polymarket copy-trading workflows (trader discovery, peak/decline cycle detection, candidate ranking, risk limits, and execution handoff). Use...

Before installing or running this skill: (1) Recognize that the scripts can place real Polymarket orders when run with --execute — do not run with --execute unless you fully trust the code and environment. (2) Confirm where signing keys live (polymarket CLI, local key store, or env vars) and never expose private keys to untrusted code. (3) Require the author to update metadata/SKILL.md to declare required binaries (polymarket, curl) and the exact credential model needed, and add explicit warnings about financial risk. (4) Test with dry-run only and inspect the polymarket CLI commands that will be executed; run in an isolated environment or with empty/funding-free accounts first. (5) If you need to allow autonomous invocation, restrict permissions and review how the agent obtains confirmations before executing orders.

Type: OpenClaw Skill Name: wangbo-polymarket-copytrading Version: 0.2.0 The skill bundle is designed for automated Polymarket copy-trading. The `scripts/auto_copytrade.py` script contains a command injection vulnerability. It constructs commands for an external `polymarket` CLI tool using values directly from the `references/auto-copytrade-config.example.json` configuration file. If an attacker could control the content of this configuration file (e.g., via a supply chain attack or prompt injection against the agent to modify the config or its path), they could inject arbitrary shell commands, leading to Remote Code Execution (RCE) and unauthorized financial transactions. This is a critical vulnerability, but not evidence of intentional malice within the skill's core logic.