Polymarket 5m Trading

• Analyzed: Apr 30, 2026, 8:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: a89265777271a973ffca3bde2264e2540164b53aacfb0c922426a731625a60ff
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements an automated Polymarket trading strategy that requires a 'WALLET_PRIVATE_KEY' for live execution. A primary security concern is located in 'run_skill.py', where the script derives Polymarket API credentials (key, secret, and passphrase) from the private key and transmits them to an external service via 'client.register_wallet_credentials'. While this behavior is documented and facilitates the use of the Aion platform for managed trading, the transmission of sensitive credentials to a third-party API (defaulting to Aion's infrastructure) constitutes a high-risk capability that could lead to unauthorized account control if the service is compromised or malicious.