Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Polymarket Executor

v2.0.0

Autonomous multi-strategy trading bot for Polymarket prediction markets. Scans ALL markets (crypto, politics, sports, economics, entertainment) for parity ar...

1· 318·1 current·1 all-time
byWesley Armando@georges91560
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name, description, code, and optional env vars align with a trading bot (Polymarket API keys, wallet, Telegram alerts). However the documentation and systemd instructions assume specific host/container paths and a particular operator ('Wesley') which is not necessary for the stated purpose and indicates the package is tailored to a particular deployment.
!
Instruction Scope
Runtime instructions go beyond simply running a bot: they instruct copying files into a specific Docker container, adding variables to a host .env, and creating a systemd service that loads that .env. These steps touch host configuration, require elevated privileges, and could expose unrelated host secrets. The SKILL.md also allows broad scanning (hundreds–thousands of markets) and continuous autonomous looping, giving the agent broad operational discretion.
Install Mechanism
There is no external install/download step; the skill is instruction + a single Python file that claims to use the standard library only. No remote archive downloads or third-party package installs were specified, reducing supply-chain risk.
Credentials
Requested environment variables (Polymarket API key/secret/passphrase, wallet address, capital, Telegram tokens) are reasonable for a live trading bot and are marked optional for paper mode. However documentation recommends placing these in a shared host .env and references an existing TELEGRAM_CHAT_ID and other owner-specific values—this risks exposing other host secrets if the same .env holds unrelated credentials.
!
Persistence & Privilege
The repo includes a systemd setup that runs the executor as root and auto-starts it on boot (Enable/Start instructions). While long-running services are expected for trading bots, running as root and loading a host EnvironmentFile increases privilege and persistence risk. The skill itself is not forced-always, but its documentation explicitly guides the user to grant high persistence and host-level privileges.
What to consider before installing
Before installing/running this skill: - Run it only in a sandboxed/isolated environment (dedicated VM or container) and keep PAPER_MODE=true until you fully audit behavior and paper-trade for many cycles. - Do not place unrelated secrets in the same host .env referenced by the service; prefer a dedicated env file for this bot and run under a non-root user. - If you intend to run it as a systemd service, avoid running it as root; run a dedicated unprivileged service account or keep it inside a controlled container with limited host mounts. - Review the full polymarket_executor.py for any hidden network endpoints or unexpected behavior (the file is included but truncated in the bundle you provided). Look for any calls to endpoints beyond Polymarket and Telegram. - Treat live-mode credentials (API key/secret, wallet address) as high-sensitivity; generate API keys locally as recommended and never upload private keys to the server. - Be skeptical of absolute performance claims (100% win rates, 'zero risk'); test thoroughly in paper mode and inspect trade execution logic, sizing, and fee/slippage handling before any real funds. - Consider rotating keys and revoking access if you later stop using the bot, and prefer running behind your own proxy/egress controls rather than following third-party proxy vendor recommendations blindly.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎯 Clawdis
Binspython3
latestvk975zt1s1jb85sy59pdt5mfewh82bpm4
318downloads
1stars
1versions
Updated 6h ago
v2.0.0
MIT-0

Polymarket Executor — Multi-Strategy Trading Bot

🎯 WHAT IT DOES

Autonomous trading bot for Polymarket prediction markets.

Starts in paper mode (simulated capital, zero risk) to validate strategy performance before deploying real money. Reads configuration from learned_config.json (adjusted automatically by polymarket-optimizer every 6 hours).

Markets covered:

  • ✅ Crypto (BTC, ETH, altcoins — price targets, daily/weekly)
  • ✅ Politics (elections, policy, polls, government decisions)
  • ✅ Sports (NBA, NFL, MLB, NHL, Soccer, UFC, Tennis, Golf)
  • ✅ Economics (Fed rates, CPI, jobs reports, GDP)
  • ✅ Technology (Apple, Tesla, Google, IPOs, launches)
  • ✅ Entertainment (Oscars, Emmys, box office)
  • ✅ Weather (hurricanes, temperature records, climate events)
  • ✅ Miscellaneous (all binary outcome markets)

Total markets scanned: 500–5000+ per cycle


⚡ QUICK START

Paper Mode (Default — No credentials needed)

cd /data/.openclaw/workspace/skills/polymarket-executor
python3 polymarket_executor.py

Expected output:

============================================================
POLYMARKET EXECUTOR v2.0.0
============================================================
[MODE] 📄 PAPER TRADING (simulated capital: $100.00)
[CONFIG] Loaded learned_config.json
[GAMMA] Fetched 2,341 markets
[SCAN] Scanning 500 markets with 50 workers...
[SCAN] Found 8 opportunities
[TRADE] PAPER: parity_arbitrage | YES+NO = $0.94 | Edge: 6.3%
[PORTFOLIO] Capital: $100.00 | Open: 2 | P&L: +$0.00

Live Mode (After paper validation)

export PAPER_MODE=false
export POLYMARKET_API_KEY="your_key"
export POLYMARKET_SECRET="your_secret"
export POLYMARKET_PASSPHRASE="your_passphrase"
export POLYMARKET_CAPITAL=50.0
python3 polymarket_executor.py

🔥 STRATEGIES

1. Parity Arbitrage — Risk: ZERO ✅

YES + NO prices don't sum to $1.00 → buy both → guaranteed profit

YES: $0.45 + NO: $0.49 = $0.94 total
Buy both → payout: $1.00 → profit: 6.4%
Risk: NONE (guaranteed regardless of outcome)

Frequency: 5–20/day | Win rate: 100%


2. Tail-End Trading — Risk: Very Low ✅

Buy >95% certainty outcomes, wait for $1.00 resolution

Fed keeps rates → 98% certain → price: $0.97
Buy at $0.97 → resolution: $1.00 → profit: 3.1%
Risk: Very low (event almost certain)

Frequency: 10–30/day | Win rate: 95–98%


3. Logical Arbitrage — Risk: Low ✅

Finds impossible price combinations between related markets

"BTC > 100k by March" = 40%
"BTC > 90k by March"  = 35%   ← IMPOSSIBLE (90k < 100k)

Buy "BTC > 90k" at 35% — must resolve ≥ "BTC > 100k"

Frequency: 2–10/day | Win rate: 90–95%


📊 RISK MANAGEMENT

ProtectionValueDescription
Kelly Criterion25% fractionConservative position sizing
Max position10% of capitalPer-market limit
Max concurrent3 tradesOpen positions cap
Circuit breaker-15% dailyHalts all trading
Stop-loss-50% per positionAuto-close losing trades
Max daily trades20Hard cap per day

🧠 ADAPTIVE LEARNING

The executor reads learned_config.json at startup. The optimizer updates this file every 6 hours.

What adapts automatically:

  • min_parity_profit — raised if false positives, lowered if win rate excellent
  • min_tail_end_certainty — adjusted based on tail-end win rate
  • min_logical_edge — tightened if logical arb underperforms
  • kelly_fraction — reduced if portfolio in drawdown
  • strategy_allocation — capital shifted toward best-performing strategies
  • scan_interval_seconds — faster scans when performing well

📁 FILES CREATED

FileDescription
paper_trades.jsonAll simulated trade records
portfolio.jsonCapital, positions, daily P&L
performance_metrics.jsonPer-strategy stats for optimizer
live_trades.jsonlReal trade log (live mode only)
learned_config.jsonOptimizer-adjusted parameters

📱 TELEGRAM ALERTS

🎯 POLYMARKET SCAN COMPLETE

📊 Markets scanned: 500
🔍 Opportunities: 8

💼 PORTFOLIO
💰 Capital: $100.00
📈 Daily P&L: +$2.34
🎯 Win Rate: 75.0%
📊 Open positions: 2

📋 OPPORTUNITIES
• parity_arbitrage: 6.3% edge
  Fed Rate Decision — Keeps...
• tail_end: 3.1% edge
  Chiefs win Super Bowl...

✅ LIVE READINESS CHECKLIST

Before switching PAPER_MODE=false:

  • 30+ resolved paper trades
  • Win rate ≥ 55%
  • Positive total P&L
  • No circuit breaker triggered
  • Polymarket API credentials configured
  • USDC on Polygon wallet
  • Residential proxy configured (VPS blocks CLOB POST)

The polymarket-optimizer will report readiness automatically.


⚠️ VPS / PROXY NOTE

Polymarket CLOB API blocks datacenter IPs (including Hostinger VPS) for POST /order.

Reading markets: works fine on VPS (no proxy needed) Placing orders: requires residential proxy in live mode

Recommended: IPRoyal, BrightData rotating residential proxy. Paper mode works 100% without proxy.


Version: 2.0.0 | License: MIT | Author: Georges Andronescu (Wesley Armando)

Comments

Loading comments...