Polymarket Mert Sniper

• Analyzed: May 12, 2026, 4:02 AM
• Findings: 1
• Version: 1.2.2
• Hash: eaf7d5d2c5934f91cd84fd4b68f583dc822afad77030c301675151a7a4448d8b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle facilitates automated trading on Polymarket but requires the user to provide a highly sensitive `WALLET_PRIVATE_KEY`, which `SKILL.md` explicitly instructs the AI agent to solicit and store in environment variables. While the logic in `mert_sniper.py` and `scripts/status.py` appears aligned with the stated purpose of market sniping, the handling of raw private keys and the reliance on an external dependency (`simmer-sdk`) for transaction signing represents a high-risk security pattern. No explicit evidence of data exfiltration or intentional malice was found in the provided code, but the credential solicitation via prompt instructions warrants a suspicious classification.