Polymarket Arb Bot

Key things to check before installing or running this skill: - Do not export or use private keys until you audit the repository. SKILL.md asks you to set POLYMARKET_PRIVATE_KEY / POLYMARKET_PROXY_ADDRESS; these are sensitive. Verify `wallet_backup.txt` does not contain any real private keys — treat it as compromised until proven otherwise and never reuse keys found in the repo. - The registry metadata underreports dependencies. The code uses node, puppeteer/playwright, openclaw CLI/browser tool, scrapling, and Python requirements. Follow the repo README and inspect requirements.txt and package.json; install deps in an isolated VM/container first. - Start with ENABLE_TRADING = False (or equivalent) and run in dry-run/simulated mode until you validate logic and network calls. Log all outgoing requests and subprocess calls during tests. - Search the repo for any plaintext secrets (API keys, private keys) and remove them. If `wallet_backup.txt` contains keys, assume they are compromised — do not fund those wallets. - Review any subprocess invocations (polymarket, node scripts, openclaw, playwright) and confirm you trust the binaries. Playwright downloads browsers and has nontrivial resource/attack surface; run in an isolated environment. - Consider using a hardware wallet / multisig (Gnosis Safe) with limited signing rights rather than placing private keys in environment variables or in source files. - If you plan to run with real funds: perform a security audit (dependency versions, network endpoints), run in a sandbox, and only use small amounts after testing. If you are not comfortable reviewing code or secrets, avoid running this skill with real wallets.