Mia Polymarket Trader

AI agent for automated prediction market trading on Polymarket

Security Scan

The skill's instructions ask for a private wallet key and reference a CLI that isn't provided or declared in the registry metadata, so the package is internally inconsistent and requires sensitive secrets without justification.

Purpose & Capability

The skill's stated purpose (automated trading on Polymarket) is plausible, but the registry metadata declares no required credentials or binaries while the SKILL.md instructs users to export POLYMARKET_API_KEY and POLYMARKET_PRIVATE_KEY and run a 'mia-polymarket' CLI. That mismatch (no declared env vars/no install vs instructions that require sensitive keys and a CLI) is incoherent: a trading skill would legitimately need API/auth credentials, but those should be declared and an install path for the CLI should be provided.

Instruction Scope

The runtime instructions explicitly tell the user/agent to set environment variables containing a private wallet key and to execute 'mia-polymarket' commands. There are no details on where 'mia-polymarket' comes from, no safety for key handling, and no indication the agent should restrict or validate transactions beyond vague safety limits. Asking to export a full private key into an env var is broad and sensitive scope creep relative to the metadata provided.

Install Mechanism

There is no install specification and no code files. Yet SKILL.md assumes a CLI ('mia-polymarket') exists. That absent install/packaging information is a red flag: either the skill expects a third-party binary not declared (which the user must fetch from an unknown source), or the skill will fail. An unknown install source + expectation of executing trades is risky.

Credentials

The instructions require POLYMARKET_API_KEY and POLYMARKET_PRIVATE_KEY (a full wallet private key). The registry declared no required env vars or primary credential, so requesting a raw private key is disproportionate and not justified. A trading integration might need API keys or a signing mechanism, but asking for an unrestricted private key is high privilege and should be explicitly declared, minimized, and handled carefully (hardware wallets, signing service, or scoped keys).

Persistence & Privilege

The skill is not always-enabled and does not request system config paths or persistent presence. However, it is able to be invoked autonomously (the platform default), which combined with the above (requests for a private key) increases risk because an autonomous agent could execute real trades if given credentials. This is a caution rather than an administrative misconfiguration in the metadata.

What to consider before installing

Do not export or paste your wallet private key into an environment variable or give it to this skill yet. The SKILL.md asks for a POLYMARKET_API_KEY and a POLYMARKET_PRIVATE_KEY but the registry metadata declares no credentials and provides no install/source for the 'mia-polymarket' CLI — this inconsistency is concerning. Before installing or using: 1) Ask the author for the source code or install instructions and verify the CLI binary's origin (official repo, signed release). 2) Require the skill to declare required env vars in the registry metadata and explain why each is needed. 3) Never provide an unrestricted private key; prefer a signing service, hardware wallet, or scoped key that can only sign transactions under constrained policies, or use testnet/faucet accounts for initial testing. 4) Verify the author identity and examine the code (or have a trusted reviewer do so) to ensure trades cannot be siphoned. 5) If you proceed, start with a dry-run/testnet and minimal funds, and monitor transactions closely. If the author cannot provide verifiable code and an explicit, minimal credential model, treat the skill as unsafe to give real funds or private keys.

AI agent that autonomously trades on Polymarket prediction markets.

Features

• Market analysis using AI
• Arbitrage opportunity detection
• Automated trade execution
• Risk management

Setup

export POLYMARKET_API_KEY="your-key"
export POLYMARKET_PRIVATE_KEY="your-wallet-key"
mia-polymarket analyze --market "tech-ai"
mia-polymarket trade --market-id "xxx" --position "yes" --amount 10

Safety

• Max 5% portfolio per trade
• Stop-loss at 20%
• Daily reporting

Author

MiaBloomx 💎