Security checks across malware telemetry and agentic risk
This trading skill is coherent, but it needs Review because it can use wallet keys to approve spending, place trades, and collect platform fees automatically.
Install only if you are comfortable giving an agent authority over a dedicated low-balance trading wallet. Before use, require manual review of every trade, token approval, spender/delegate, fee recipient, fee amount, and allowance scope; avoid broad or persistent approvals, pin and verify the external SDK packages, and do not log derived API credentials.
3. **Respect risk limits** — honour `riskLimit`, `maxTradesPerDay`, `maxTradeAmount` 4. **Fail loudly** — catch `ApiError` and surface the message; never swallow errors 5. **Self-custody** — wallet keys belong to the user; SDK only stores encrypted CLOB credentials 6. **Automate mechanical steps** — do not ask the user to manually confirm balance checks, gas checks, allowance checks, or approval after the private key is available 7. **Verify execution independently** — if the wrapper response is weak, validate through the corresponding venue (Polymarket or Kalshi) before reporting failure ---
- default trade mode: `market` - default buy size: `2` USDC - default behavior: auto-select a valid market candidate from the requested strategy scope - default pre-trade workflow: derive wallet, register wallet credentials, check balance, check gas, check allowance, auto-approve if needed, then trade - default post-trade workflow: query recent venue-specific trades/orders (Polymarket orders or Kalshi positions/orders) if the SDK result is generic, null, or ambiguous The agent should ask the user only for information it cannot safely infer or execute itself.
- Cancel stale open orders promptly - Rotate API keys every 90 days - Prefer market orders for simple one-shot execution unless the user explicitly requests a limit order - Auto-approve required spenders when allowance is missing and gas is sufficient ### AVOID
1. User's Safe wallet must have **AllowanceModule** enabled 2. Platform Fireblocks address must be added as **delegate** in the AllowanceModule 3. Sufficient **pUSD token allowance** must be configured on the module 4. The agent should verify allowance before trading and auto-approve if gas is available **Kalshi (USDC on Solana):**
- [ ] `get_me()` returns valid agent info - [ ] Polymarket CLOB credentials derived from private key and registered via `register_wallet_credentials()` - [ ] automatic balance, gas/fees, and allowance checks are part of the trading flow - [ ] missing allowance is auto-approved when technically possible - [ ] Risk limits configured via `update_settings()` - [ ] Heartbeat loop (`get_briefing()`) running or planned - [ ] Error handling wraps every SDK call with `ApiError`
60/60 vendors flagged this skill as clean.
