Polymarket Auto-Trader

• Analyzed: May 12, 2026, 3:52 AM
• Findings: 1
• Version: 1.0.1
• Hash: a3aac0ee649b3a7b87e7a5705d4ec6d82749b2c5324b4473a866137101e9651c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle sets up an autonomous trading bot that handles a blockchain private key and grants unlimited token spending approvals (MAX_UINT) to Polymarket contracts. While these high-risk actions (storing a private key in `.env`, broad token approvals, cron-based persistence, external LLM API calls) are transparently disclosed in `SKILL.md` and appear to be for the stated purpose of autonomous trading with legitimate services (Polymarket, Anthropic), the inherent vulnerabilities are significant. There is no evidence of intentional malicious behavior like unauthorized data exfiltration or covert backdoors, but the critical nature of the private key handling and unlimited approvals warrants a 'suspicious' classification due to the high potential for financial loss if the environment is compromised or the target contracts have vulnerabilities.