Polymarket Fast Loop
WarnAudited by ClawScan on May 10, 2026.
Overview
This is a disclosed Polymarket trading bot, but it asks for a raw wallet private key and encourages unattended live trades with real USDC.
Only install this if you intentionally want automated real-money Polymarket trading. Use a fresh low-balance wallet, start with dry-run, verify the publisher and SDK dependency, set strict budget limits, and do not enable cron or heartbeat until you understand how to stop it.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the key or environment is exposed, the wallet's funds and trading authority could be misused.
A raw wallet private key is broad financial authority over the user's Polymarket wallet. This is purpose-related for live trading, but it is high-impact and not narrowly scoped.
Ask for wallet private key ... Store in environment as `WALLET_PRIVATE_KEY` ... The SDK uses this to sign orders client-side automatically
Use only a dedicated, low-balance wallet for this skill, protect the environment variable carefully, and avoid using a main wallet private key.
A bad signal, configuration mistake, or repeated cron run could spend funds or open unwanted positions.
The documented workflow can run unattended live trades on a schedule. That is aligned with the trading-bot purpose, but it creates real-money actions without per-trade user approval.
All trades execute on Polymarket with real USDC. Use `--live` for real trades ... */5 * * * * cd /path/to/skill && python fastloop_trader.py --live --quiet
Start in dry-run mode, keep small max-position and daily-budget limits, monitor early runs, and only enable cron after confirming behavior.
Users have less assurance that the reviewed package identity matches the registry listing they intended to install.
The embedded metadata differs from the supplied registry metadata, which lists a different owner ID, slug `polymarketbot`, and version `0.1.0`. For a skill requesting wallet trading authority, this provenance mismatch is material.
"ownerId": "kn7axnp7bzqsf5fkx0z8px7han7zyq1x", "slug": "polymarket-fast-loop", "version": "1.0.15"
Verify the publisher and package identity before installing, and prefer a corrected release with matching registry and embedded metadata.
A changed or unexpected SDK version could affect trading behavior or credential handling.
The skill depends on the unpinned `simmer-sdk` package for trading functionality. This dependency is purpose-aligned, but users should verify it because it is involved in live trading.
metadata: {"clawdbot":{"requires":{"env":["SIMMER_API_KEY"],"pip":["simmer-sdk"]}Install from a trusted package source and consider pinning a known-good `simmer-sdk` version.
The bot may continue making trading decisions on schedule until the loop or cron job is stopped.
Recurring operation is disclosed and user-directed rather than hidden autostart, but it can keep trading after setup if the user enables cron or heartbeat.
The script runs **one cycle** — your bot drives the loop. Set up a cron job or heartbeat
Document how to disable the cron/heartbeat, monitor runs, and stop the loop before changing wallet funding or strategy settings.