Vincent - Polymarket

• Analyzed: May 14, 2026, 3:31 AM
• Findings: 1
• Version: 1.0.70
• Hash: c8cb7f12a38bdf4f7d555fbfed309d2163579d797e44795566216f79a062d896
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill enables an AI agent to autonomously trade on Polymarket and manage financial assets, including high-risk capabilities such as fund withdrawal (`polymarket withdraw`) and cross-wallet transfers (`wallet transfer-between`). It relies on a third-party service (heyvincent.ai) for key management and executes code via `npx @vincentai/cli`, which introduces supply chain risks. While the documentation (SKILL.md) describes a security model with server-side policies and human oversight, the inherent risk of an agent handling financial transactions and storing API keys locally in `${HOME}/.openclaw` justifies a cautious classification.