Polymarketodds 1.0.0

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a purpose-aligned Polymarket data viewer with disclosed local storage and optional user-set cron alerts; no artifact-backed malicious behavior was found.

This looks reasonable for a Polymarket odds and paper-trading helper. Before installing, be aware that it will query Polymarket's public API, can keep local watchlist and simulated portfolio files, and any cron jobs you add will keep running until you remove them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI10: Rogue Agents

What this means

If you add the cron job, the skill may continue checking Polymarket alerts on a schedule.

Why it was flagged

The skill recommends a recurring scheduled alert command. This is user-directed and disclosed, but it can keep running until the user removes the cron entry.

Skill content

Set Up Hourly Alerts (Cron)
python3 {baseDir}/scripts/polymarket.py alerts --quiet

Recommendation

Only add cron jobs you actually want, and keep a note of how to remove or disable them.

Low

#ASI06: Memory and Context Poisoning

What this means

Anyone with access to your local account could see your watched markets and simulated trading history.

Why it was flagged

The skill persists user watchlists, alert thresholds, and simulated trades locally. This is disclosed and purpose-aligned, but it creates a local record of user interests and predictions.

Skill content

Watchlist and portfolio stored in `~/.polymarket/`:
- `watchlist.json` — Watched markets and alert thresholds
- `portfolio.json` — Paper positions and trade history

Recommendation

Do not store secrets in these files, and delete or protect ~/.polymarket if you do not want to keep that history.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The package identity is slightly inconsistent, so users should be more careful about confirming they are installing the intended skill.

Why it was flagged

The registry metadata in the review input lists a different owner ID and a version-suffixed slug, while the artifact _meta.json lists this owner/slug. This is a minor provenance inconsistency rather than evidence of malicious behavior.

Skill content

"ownerId": "kn7a3xe57dnqxgg5kfp78twfj98022a5", "slug": "polymarketodds"

Recommendation

Verify the skill publisher and homepage before installation, especially because the source is listed as unknown.