Neckr0ik Polymarket Paper
PassAudited by ClawScan on May 10, 2026.
Overview
This looks like a local paper-trading simulator, but users should know it stores trading data locally and the visible code uses sample markets rather than the advertised live Polymarket data.
This appears safe to use as a local paper-trading demo, but verify the full script and command source before running it. Expect account and trade data to be saved locally, and do not assume the displayed markets or prices are live Polymarket data unless the maintainer provides clear implementation and disclosure.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Users may believe their practice trades reflect live Polymarket pricing when the visible code uses hardcoded sample prices.
The visible implementation appears to be a sample-data simulator despite documentation advertising live prices. This is a capability/disclosure mismatch, but the artifacts do not show harmful actions or data exfiltration.
SKILL.md: "**Real market data** — Live Polymarket prices"; scripts/paper_trading.py: "# In production, this would fetch from Polymarket API" and "# For now, use sample data"
Treat this as a demo unless the maintainer clearly implements and discloses live data fetching; do not rely on it for real trading decisions.
Paper-trading account names, positions, and trade history will remain on the local machine until deleted.
The skill creates a persistent local data directory and saves account, position, and trade history there.
self.data_dir = Path(data_dir or Path.home() / ".polymarket-paper") ... account_file.write_text(json.dumps(data, indent=2))
Use non-sensitive account names, review exported or saved files before sharing, and delete ~/.polymarket-paper if you want to remove the local history.
The documented command may not exist, or a similarly named executable on the user's PATH could be run instead if the user tries the examples manually.
The documentation tells users to run a CLI command, but the artifacts do not include an install spec or declared binary that establishes where that command comes from.
SKILL.md: "neckr0ik-polymarket-paper create-account --name \"MyPortfolio\""; Install specifications: "No install spec — this is an instruction-only skill."
Verify the command source before running it, or run only the reviewed script directly from the skill package.