Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Polymarket Trade 1.0.6

v1.0.0

Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.

0· 104·3 current·3 all-time
byVolica.X@xvolica

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for xvolica/polymarket-trade-1-0-6.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Polymarket Trade 1.0.6" (xvolica/polymarket-trade-1-0-6) from ClawHub.
Skill page: https://clawhub.ai/xvolica/polymarket-trade-1-0-6
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install polymarket-trade-1-0-6

ClawHub CLI

Package manager switcher

npx clawhub@latest install polymarket-trade-1-0-6
Security Scan
Capability signals
CryptoRequires wallet
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description (query Polymarket, trending, watchlist, paper trading) matches the required binary (python3) and the included script which calls the public Gamma API. However registry metadata and embedded _meta.json/version strings disagree (registry shows different ownerId/version than the packed _meta.json), which is an integrity/provenance concern.
Instruction Scope
Runtime instructions tell the agent/user to run the included Python script and to store watchlist/portfolio under ~/.polymarket; those actions are consistent with the stated features. The SKILL.md is truncated near the end (cut off at "Does not send any personal..."), so the full documented behavior/limitations are not present — review the remaining documentation or the code to confirm there is no unexpected data collection or external calls.
Install Mechanism
No install spec (instruction-only with an included script). This is lower-risk than arbitrary downloads. The only runtime dependency declared is python3 and the script itself lists 'requests' in its header comments which is appropriate for HTTP calls.
Credentials
No environment variables or external credentials are requested. The skill reads/writes only to a per-user data directory (~/.polymarket) as described, which is proportionate to watchlist/portfolio features.
Persistence & Privilege
The skill is not always-enabled, and disable-model-invocation is true (the skill will not be invoked autonomously). It does create local files under the user's home directory (expected), and does not request elevated/system-wide privileges.
What to consider before installing
Before installing: 1) Verify provenance — the bundle's registry metadata (ownerId/version) does not match the _meta.json inside the package; confirm the publisher and get the script from a trusted source (official Polymarket repo or a verified GitHub release). 2) Inspect the full scripts/polymarket.py for any outgoing network calls beyond the documented gamma-api.polymarket.com, any POSTs/webhooks, or uses of subprocess/os.system. Search for 'requests.post', 'socket', 'subprocess', 'os.system', 'open(' with non-local paths, or hardcoded URLs. 3) Because SKILL.md is truncated, read the full README or run a static review of the code to confirm data-handling claims (no credentials sent). 4) Run the script in a sandboxed environment (or as an unprivileged user) first, and monitor network traffic to confirm it only queries gamma-api.polymarket.com. 5) If you plan to use cron/alerts, be aware the tool writes to ~/.polymarket — back up or audit those files if you store sensitive information there. If you cannot validate the origin or inspect the code, avoid installing or run it only in an isolated environment.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📊 Clawdis
Binspython3
latestvk97erfzqfxkzqhjt107mxz9dzd84aaq3
104downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Step-by-Step Guide

https://telegra.ph/How-Building-a-Weather-Polymarket-Bot-with-OpenClaw-Skill-and-turn-100--8000-Step-by-Step-Guide-02-28-2

Polymarket

Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.

Quick Start

# Trending markets
python3 {baseDir}/scripts/polymarket.py trending

# Search
python3 {baseDir}/scripts/polymarket.py search "trump"

# Biggest movers
python3 {baseDir}/scripts/polymarket.py movers

# What's resolving soon
python3 {baseDir}/scripts/polymarket.py calendar

After Install — Suggested Setup

1. Add to Morning Briefing

Add Polymarket to your daily cron:

polymarket featured + polymarket movers --timeframe 24h

2. Watch Markets You Care About

# Watch with price target alert
python3 {baseDir}/scripts/polymarket.py watch add trump-2028 --alert-at 60

# Watch with change alert (±10% from current)
python3 {baseDir}/scripts/polymarket.py watch add bitcoin-100k --alert-change 10

3. Set Up Hourly Alerts (Cron)

# Check watchlist every hour, only notify on alerts
python3 {baseDir}/scripts/polymarket.py alerts --quiet

4. Weekly Category Digests

# Every Sunday: politics digest
python3 {baseDir}/scripts/polymarket.py digest politics

5. Paper Trade to Track Predictions

python3 {baseDir}/scripts/polymarket.py buy trump-2028 100  # $100 on Trump
python3 {baseDir}/scripts/polymarket.py portfolio           # Check P&L

Commands

Core

# Trending markets (by 24h volume)
python3 {baseDir}/scripts/polymarket.py trending

# Featured/high-profile markets
python3 {baseDir}/scripts/polymarket.py featured

# Search markets
python3 {baseDir}/scripts/polymarket.py search "giannis"

# Get event by slug
python3 {baseDir}/scripts/polymarket.py event trump-2028

# Browse by category
python3 {baseDir}/scripts/polymarket.py category politics

Watchlist + Alerts (NEW)

# Add to watchlist
python3 {baseDir}/scripts/polymarket.py watch add trump-2028
python3 {baseDir}/scripts/polymarket.py watch add bitcoin-100k --alert-at 70
python3 {baseDir}/scripts/polymarket.py watch add fed-rate-cut --alert-change 15

# Watch specific outcome in multi-market
python3 {baseDir}/scripts/polymarket.py watch add giannis-trade --outcome warriors

# List watchlist with current prices
python3 {baseDir}/scripts/polymarket.py watch list

# Remove from watchlist
python3 {baseDir}/scripts/polymarket.py watch remove trump-2028

# Check for alerts (for cron)
python3 {baseDir}/scripts/polymarket.py alerts
python3 {baseDir}/scripts/polymarket.py alerts --quiet  # Only output if triggered

Resolution Calendar (NEW)

# Markets resolving in next 7 days
python3 {baseDir}/scripts/polymarket.py calendar

# Markets resolving in next 3 days
python3 {baseDir}/scripts/polymarket.py calendar --days 3

# More results
python3 {baseDir}/scripts/polymarket.py calendar --days 14 --limit 20

Momentum Scanner (NEW)

# Biggest movers (24h)
python3 {baseDir}/scripts/polymarket.py movers

# Weekly movers
python3 {baseDir}/scripts/polymarket.py movers --timeframe 1w

# Monthly movers with volume filter
python3 {baseDir}/scripts/polymarket.py movers --timeframe 1m --min-volume 50

Category Digests (NEW)

# Politics digest
python3 {baseDir}/scripts/polymarket.py digest politics

# Crypto digest
python3 {baseDir}/scripts/polymarket.py digest crypto

# Sports digest
python3 {baseDir}/scripts/polymarket.py digest sports

Categories: politics, crypto, sports, tech, business

Paper Trading (NEW)

# Buy $100 of a market
python3 {baseDir}/scripts/polymarket.py buy trump-2028 100

# Buy specific outcome
python3 {baseDir}/scripts/polymarket.py buy giannis-trade 50 --outcome warriors

# View portfolio
python3 {baseDir}/scripts/polymarket.py portfolio

# Sell position
python3 {baseDir}/scripts/polymarket.py sell trump-2028

Starts with $10,000 paper cash. Track your predictions without real money.


Data Storage

Watchlist and portfolio stored in ~/.polymarket/:

  • watchlist.json — Watched markets and alert thresholds
  • portfolio.json — Paper positions and trade history

Cron Examples

Hourly Alert Check

0 * * * * python3 ~/.../polymarket.py alerts --quiet

Daily Morning Brief

0 7 * * * python3 ~/.../polymarket.py movers && python3 ~/.../polymarket.py calendar --days 1

Weekly Digests

0 10 * * 0 python3 ~/.../polymarket.py digest politics
0 10 * * 0 python3 ~/.../polymarket.py digest crypto

Output Features

Markets show:

  • Current odds (Yes/No prices)
  • Price momentum (24h/1wk/1mo changes with arrows)
  • Volume (total + 24h activity)
  • Time remaining
  • Bid/ask spread

API

Uses the public Gamma API (no auth required for reading):


Security & Permissions

No API key or authentication required. This skill uses Polymarket's public Gamma API.

What this skill does:

  • Makes HTTPS GET requests to gamma-api.polymarket.com (public, unauthenticated)
  • Reads market data: odds, volumes, event details, price history
  • Paper trading is local simulation only — stored in ~/.polymarket/ as JSON files
  • No real money, no wallet, no blockchain transactions

What this skill does NOT do:

  • Does not connect to any wallet or financial account
  • Does not execute real trades or transactions
  • Does not require or handle any credentials or API keys
  • Does not send any personal data externally
  • Cannot be invoked autonomously by the agent (disable-model-invocation: true)

Data stored locally: ~/.polymarket/watchlist.json, ~/.polymarket/portfolio.json

Review scripts/polymarket.py before first use to verify behavior.

Note

This is read-only + paper trading. Real trading requires wallet authentication (not implemented).

Comments

Loading comments...