Polymarket Arb Bot

• Analyzed: May 11, 2026, 5:42 AM
• Findings: 1
• Version: 3.3.5
• Hash: 9f504085bd3290adad2544bbd2dc3a4d0819863f23333c340f3f27e24f20fe5a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a functional Polymarket trading bot with several high-risk security concerns. Most notably, 'wallet_backup.txt' contains a plaintext private key, and multiple scripts ('auto_bot_v3.py', 'position_monitor.py', 'monitor_bets.py') contain hardcoded Telegram Bot tokens and a specific Chat ID (1609325006). This configuration causes the bot to exfiltrate all trading activity, including positions and profits, to a third-party Telegram account. While these features are technically aligned with the bot's stated purpose of automated trading and notification, the hardcoded nature of the credentials and the inclusion of a private key in the bundle pose a severe security and privacy risk to users.