ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Polymarket Sniper Bot (Standalone)

v1.0.1

An autonomous trading agent for Polymarket (Polygon). Scans 15-minute markets for momentum and trades automatically. Includes dashboard, simulation mode, and...

⭐ 0· 81·1 current·1 all-time
by@wjs829
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The files (polymarket.py, dashboard, db, bootstrap, agent.yaml) align with the stated purpose (autonomous Polymarket trading + dashboard). However registry metadata declares no required env vars or credentials while the code expects a config.yaml containing wallet_private_key, polygon_rpc_url, clob_api_key/secret/passphrase and the runtime uses an environment PRO_LICENSE_KEY and LICENSE_SERVER — these credentials are necessary for the bot to function but are not declared in metadata, which is an incoherence.
!
Instruction Scope
SKILL.md and DEPLOYMENT instruct users to run bootstrap.sh and start the dashboard and mention enabling live_trading via config.yaml, but the runtime enforces live mode via a PRO license (validate_pro_license() reads PRO_LICENSE_KEY and contacts LICENSE_SERVER). That discrepancy (config flag vs env/license gating) is inconsistent. The runtime will make multiple external network calls (Gamma API, CLOB API, optional Discord webhook, and the LICENSE_SERVER) and can place real trades if live — these network/external interactions are within the bot's purpose but the license check/contact to an external server is unexpected from the docs and could expose a provided PRO key.
ℹ
Install Mechanism
There is no formal install spec in the registry, but the included bootstrap.sh performs pip3 install -r requirements.txt with the flag --break-system-packages (bypassing PEP 668 protections). Dependencies are unpinned (no versions/hashes). Network install via pip is normal for Python but unpinned packages + --break-system-packages increases risk and surprises system-managed Python environments.
!
Credentials
A trading bot legitimately needs an RPC URL, wallet private key, and exchange/API credentials (these are referenced in docs and config.yaml), so keys in config.yaml are proportionate. However: 1) PRO_LICENSE_KEY and LICENSE_SERVER are used from environment variables but are not declared in the registry's required envs; 2) LICENSE_SERVER defaults to an HTTP endpoint (http://localhost:8080) and the code POSTs the PRO key to it — if the server URL is changed to an external host this would transmit your PRO key (and could be used to gate live trading). The registry metadata omission and external license call are disproportionate/unexpected telemetry surface.
ℹ
Persistence & Privilege
The skill does not request always:true and does not modify other skills. It writes config.yaml (from example) and creates sniper.db in the working directory; agent.yaml contains cron tasks for OpenClaw but these are only registered if the user runs the openclaw commands. The bootstrap script's system-bypass pip flag can affect system Python packages — a modest privilege/risk that users should be aware of.
What to consider before installing
This package looks like a real Polymarket sniper bot, but several things don't add up and you should be cautious: - Secrets and configuration: The bot needs a polygon RPC URL, wallet_private_key, and Polymarket CLOB API keys (these live in config.yaml). Do NOT put real/mainnet funds or your primary wallet private key in config.yaml until you fully trust the code — test with a burner wallet. The registry metadata did not declare these envs/credentials, so assume the publisher omitted them by mistake or intentionally. - License / remote contact: The code will POST PRO_LICENSE_KEY to LICENSE_SERVER to validate a 'Pro' license. This env var and server are not documented in the registry metadata. If you set a non-local LICENSE_SERVER it will transmit the PRO key over the network (note default is http:// not https). Only set PRO_LICENSE_KEY and LICENSE_SERVER if you trust the destination; otherwise leave unset (the code then runs in simulation mode). - Bootstrap risks: bootstrap.sh runs pip3 install -r requirements.txt with --break-system-packages and unpinned packages. That can modify your system Python environment. Prefer installing inside a controlled virtualenv, container, or isolated VM; consider pinning package versions and auditing dependencies before installing. - Dashboard exposure: The Flask dashboard listens on 0.0.0.0:5000 by default. Do not expose this port to the public internet; restrict access (firewall, SSH tunnel) if you run it on a remote server. - Incoherent docs vs behavior: DEPLOYMENT.md says enable live_trading via config.yaml, but the code gates live trading by validating a PRO license. Clarify this mismatch with the author before trusting 'live' mode. Recommended steps before running with real funds: 1) Review config.yaml.example and the code paths that send external requests (LICENSE_SERVER, GAMMA_API, CLOB_API, Discord webhook). 2) Run in simulation mode with a burner wallet and watch behavior. 3) Run inside an isolated environment (container/VM/virtualenv) and pin dependencies. 4) Consider replacing or validating LICENSE_SERVER with a safe value (or unset PRO_LICENSE_KEY). 5) If unsure about the source (homepage unknown), prefer not to run with real keys/funds.

Like a lobster shell, security has layers — review code before you run it.

latestvk975zhq2212k31ee9jdk4gvw4n83mkyg

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🤖 Clawdis

Comments