Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Polymarket Edge Trader

v1.0.1

Trades the highest-edge active AION Polymarket market matching a query using a user-supplied fair probability, AION context safeguards, and Kelly-style sizing.

0· 60·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for fivegive249-ship-it/polymarket-edge-trader.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Polymarket Edge Trader" (fivegive249-ship-it/polymarket-edge-trader) from ClawHub.
Skill page: https://clawhub.ai/fivegive249-ship-it/polymarket-edge-trader
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install polymarket-edge-trader

ClawHub CLI

Package manager switcher

npx clawhub@latest install polymarket-edge-trader
Security Scan
Capability signals
CryptoRequires walletRequires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description describe an AION/Polymarket trading template and the code imports AionMarketClient and implements market discovery, sizing, and conditional live execution — that aligns with the stated purpose. The environment variables declared (AION_API_KEY, WALLET_PRIVATE_KEY optional, WALLET_ADDRESS, AION_SIGNED_ORDER_JSON) are appropriate for a trading client. However, the SKILL.md suggests installing 'aion-sdk' while the manifest (clawhub.json) requires 'aionmarket-sdk' and the code imports 'aionmarket_sdk': this mismatch is inconsistent and could lead to installing the wrong package.
Instruction Scope
Runtime instructions limit network access to the AION API via the SDK and require explicit --live plus a signed order payload to execute trades; dry-run is the default. The SKILL.md and manifest declare the env vars used and the code reads the same set of variables for queries, sizing, and live execution. No unexpected file reads/writes or external endpoints are described in the instructions beyond the AION_BASE_URL. The default AION_BASE_URL (https://pm-t1.bxingupdate.com/bvapi) is not an obviously official Polymarket host — this unusual default endpoint should be verified.
!
Install Mechanism
This is instruction-only (no install script), but clawhub.json lists a pip dependency 'aionmarket-sdk'. The SKILL.md instructs users to 'pip install aion-sdk' which conflicts with the manifest. This inconsistency increases risk of installing the wrong third-party package; there is no install from arbitrary URLs, but you must verify the exact package name and its provenance before installing.
Credentials
The primaryEnv is AION_API_KEY which fits the AION SDK usage. WALLET_PRIVATE_KEY is optional and declared as such; AION_SIGNED_ORDER_JSON / WALLET_ADDRESS are required only for live submission. Requiring a private key is expected for self-custody trading, but it is a high-value secret — the skill does not need the private key for dry runs. Ensure you understand when/if you provide the private key and prefer pre-signed orders instead.
Persistence & Privilege
always:false (good). However, clawhub.json includes cron: '*/30 * * * *' and automaton.managed:true with an entrypoint, so the skill is configured to run on a schedule (every 30 minutes) when enabled. That scheduled/autonomous execution is reasonable for a trading bot but increases the importance of verifying endpoints, dependencies, and secrets before enabling.
What to consider before installing
This skill appears to implement an AION/Polymarket trading template and mostly asks only for trading-related credentials, but proceed cautiously: 1) Do not provide WALLET_PRIVATE_KEY unless you fully trust the code and have audited the full script (the repo/source is unknown). Prefer using pre-signed orders (AION_SIGNED_ORDER_JSON) for live trades. 2) Verify the correct SDK package name and provenance — the SKILL.md says 'aion-sdk' while the manifest/code refer to 'aionmarket-sdk'/'aionmarket_sdk'; install only the official library from a trusted source. 3) Confirm the AION_BASE_URL value (default https://pm-t1.bxingupdate.com/bvapi) — it does not look like a widely-known public Polymarket host; ask the author or use the official production API endpoint. 4) Keep the skill in dry-run mode first and review full edge_trader.py (the provided file was truncated in the listing) to ensure there are no hidden network calls or secret exfiltration. 5) Be aware this skill is configured to run every 30 minutes when enabled — disable or remove the cron/automaton if you want manual control. If you can get the original source repository or an official homepage from the author, that would raise confidence.

Like a lobster shell, security has layers — review code before you run it.

latestvk97c1405myz68zjtqa774ey03185gmt2
60downloads
0stars
2versions
Updated 2d ago
v1.0.1
MIT-0

Polymarket Edge Trader

Setup

Install the AION SDK:

pip install aion-sdk

This is a template. The default signal is a user-supplied fair YES probability for markets matching MARKET_QUERY. Remix the query, the probability model, or the candidate selection logic. The skill already handles market discovery, dry-run safety, pre-trade context checks, position sizing, operator summaries, and AION trade tagging.

What It Does

  • Scans active AION Polymarket markets matching MARKET_QUERY
  • Scores each candidate against MODEL_PROBABILITY
  • Picks the market with the largest absolute edge
  • Skips trades when edge is too small, slippage is too high, briefing risk alerts are active, or AION warns about flip-flopping
  • Sizes the position with a Kelly-style bankroll model
  • Prints an operator summary with risk state, decisions, and order updates
  • Executes through AionMarketClient.trade() when you explicitly provide --live and a signed order payload

Defaults

  • MARKET_QUERY=bitcoin
  • MODEL_PROBABILITY=0.60
  • TARGET_VENUE=polymarket
  • MAX_MARKETS=25
  • MAX_STAKE_USD=50
  • MIN_EDGE=0.03
  • MAX_SLIPPAGE_PCT=0.15
  • STARTING_BALANCE_USD=1000
  • AION_BASE_URL=https://pm-t1.bxingupdate.com/bvapi
  • AION_KELLY_MULTIPLIER=0.25
  • AION_MIN_EV=0.03
  • WALLET_ADDRESS=
  • AION_SIGNED_ORDER_JSON=

How To Run

Dry-run is the default:

python edge_trader.py

Trade a different query with a custom fair probability:

python edge_trader.py --query "fed" --probability 0.64

Live trading requires an explicit live flag, a wallet address, and a pre-signed order payload:

WALLET_ADDRESS=0xYourWallet \
AION_SIGNED_ORDER_JSON='{"maker":"...","signer":"...","taker":"0x0000000000000000000000000000000000000000","tokenId":"...","makerAmount":"...","takerAmount":"...","side":"BUY","expiration":"...","signature":"...","salt":"...","signatureType":0,"nonce":"...","feeRateBps":"0"}' \
python edge_trader.py --query "bitcoin" --probability 0.58 --live

Required Credentials

  • AION_API_KEY is always required
  • WALLET_PRIVATE_KEY is optional and only needed for self-custody Polymarket trading
  • WALLET_ADDRESS is required for user-scoped briefing and live order submission
  • AION_SIGNED_ORDER_JSON is only required for live order submission, because the AION SDK expects a complete signed order payload

Remix Ideas

  • Replace MODEL_PROBABILITY with your own model output or external API
  • Swap discover_markets() for briefing.opportunityMarkets or another shortlist source
  • Generate the signed order JSON from your own order builder or wallet flow before calling --live
  • Add sell logic or rebalance logic around existing positions
  • Tighten or relax the context filters for a higher-frequency strategy

Comments

Loading comments...