Polymarket Arb Bot

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI05: Unexpected Code Execution

What this means

A compromised or malicious market-data response could run code locally under the user's account.

Why it was flagged

The bot evaluates a market-data field as Python code. If that field is malformed or controlled through an upstream/API compromise, it could execute arbitrary code on the user's machine.

Skill content

token_ids = eval(markets[0].get('clobTokenIds', '[]'))

Recommendation

Replace eval with safe parsing such as json.loads, validate the expected list format, and reject unexpected values.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone with a valid wallet private key can control the associated wallet and potentially move or spend funds.

Why it was flagged

The static scan reports that the package includes a wallet backup file containing private-key material.

Skill content

Private Key: [REDACTED]

Recommendation

Do not use any bundled wallet key. Remove the backup file from the package, rotate any exposed key, and use a fresh low-balance wallet only.

ConcernHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Users may not realize before install that the skill needs sensitive wallet authority capable of placing real trades.

Why it was flagged

The skill asks for wallet-signing credentials, while the registry metadata declares no required env vars and no primary credential.

Skill content

export POLYMARKET_PRIVATE_KEY="your_private_key"
export POLYMARKET_PROXY_ADDRESS="your_gnosis_safe_address"

Recommendation

Declare wallet credentials explicitly in metadata, document exact scope and storage expectations, and avoid broad private-key access where delegated or limited credentials are possible.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Once enabled and running, the bot can spend funds automatically based on its strategy without per-order approval.

Why it was flagged

The code directly invokes the Polymarket CLI to create buy orders using wallet signing authority.

Skill content

"polymarket", "clob", "create-order", "--signature-type", "gnosis-safe", "--token", token_id, "--side", "buy"

Recommendation

Run only with a small isolated wallet, add explicit spending limits and daily loss limits, and require user confirmation unless unattended trading is intentionally enabled.

ConcernHigh Confidence

ASI10: Rogue Agents

What this means

The bot can continue operating and trading after the terminal is closed or after a crash, which increases the chance of unintended ongoing financial activity.

Why it was flagged

The instructions run the trading bot in the background and add a cron watchdog that automatically restarts it every five minutes.

Skill content

python3 auto_bot_v3.py > logs/bot_v3.log 2>&1 &
...
*/5 * * * * /path/to/watchdog_v3.sh

Recommendation

Avoid enabling the watchdog until fully tested, document how to stop and remove cron entries, and add clear kill-switch controls.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users depend on whatever package version is current at install time, which matters more because the tool handles trading authority.

Why it was flagged

The skill documents a global install of an unpinned npm package that is central to wallet-backed trading operations.

Skill content

"kind": "shell", "command": "npm i -g @polymarket/clob-client"

Recommendation

Pin package versions, publish a clear install spec, and verify package provenance before using it with wallet credentials.

NoteMedium Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Users may over-trust the bot and allocate more funds than they can afford to lose.

Why it was flagged

The report makes strong profitability/reliability claims for an automated trading system, even though trading outcomes remain uncertain.

Skill content

模型可靠性：84.6% 总体准确率证明模型有效 ... 实盘可行性：高质量信号（97.1%）足以支撑盈利 ... 已验证，可投入实盘

Recommendation

Treat performance claims as unverified, backtest independently, paper-trade first, and keep real-money exposure low.

Findings (3)

critical

suspicious.dynamic_code_execution

Location: auto_bot_v2.py:272
Finding: Dynamic code execution detected.

critical

suspicious.dynamic_code_execution

Location: auto_bot_v3.py:80
Finding: Dynamic code execution detected.

critical

suspicious.exposed_secret_literal

Location: wallet_backup.txt:10
Finding: File appears to expose a hardcoded API secret or token.