Security checks across malware telemetry and agentic risk
Polyclaw is openly an autonomous real-money trading and social-posting skill, but it gives a persistent backend powerful financial and public-action authority that needs careful review.
Install only if you intentionally want a persistent autonomous trading agent using real funds and public posting. Verify the official backend URL with the publisher, start with small funds, keep trading/posting disabled until configured, avoid storing API keys in agent memory or transcripts, rotate keys if exposed, and confirm pause, withdrawal, delete, and credential-revocation controls before funding.
**Example Request:**
```bash
curl -X POST "https://polyclaw-workers.nj-345.workers.dev/agents/550e8400.../credentials" \
-H "Authorization: Bearer pc_agent_x1y2z3..." \
-H "Content-Type: application/json" \
-d '{**Example Request:**
```bash
curl -X POST "https://polyclaw-workers.nj-345.workers.dev/agents/550e8400.../orders/submit" \
-H "Authorization: Bearer pc_agent_x1y2z3..." \
-H "Content-Type: application/json" \
-d '{Delete an agent and all associated data.
```
DELETE /agents/{id}
Authorization: Bearer {agentApiKey}
```64/64 vendors flagged this skill as clean.