庄家异动探测器

实时监控Polymarket大额资金异动，分析庄家持仓变化和胜率分布，支持0.01U加密支付回调。

Security Scan

The skill's functionality (Polymarket monitoring + paid access) mostly matches its code, but there is a hardcoded SkillPay API key in main.py and inconsistencies between declared/required environment variables — this could cause payments to be routed to the developer or otherwise be misconfigured.

Purpose & Capability

Name, SKILL.md, skill.yaml and code all implement Polymarket monitoring and an integrated SkillPay payment flow, which is coherent with the stated purpose. However, metadata in the registry summary (which listed no required env vars) conflicts with the included skill.yaml (which declares SKILLPAY_API_KEY required). That mismatch is unexpected and should be clarified.

Instruction Scope

SKILL.md instructs running a FastAPI service that handles payment callbacks and returns market movers. The code implements /invoke and outbound calls to Polymarket and SkillPay. The instructions are otherwise scoped to the described purpose, but the docs are light on webhook/callback security and the service enables permissive CORS (allow_origins=['*']), which increases exposure if deployed publicly.

Install Mechanism

No installer or external downloads; this is an instruction+code skill with a small set of Python dependencies listed in requirements.txt. Nothing in the install mechanism appears disproportionate.

Credentials

skill.yaml correctly declares SKILLPAY_API_KEY as required (appropriate for a payment integration), but main.py contains a hardcoded SKILLPAY_API_KEY literal default value. This contradiction is risky: if a user does not override the environment variable, the embedded key will be used — meaning payments could be routed to the developer's SkillPay account without the user's clear consent. No other unrelated secrets are requested.

Persistence & Privilege

The skill is not always-enabled, does not request elevated agent privileges, and does not attempt to modify other skills or system-wide configs. It only requires network access (declared in skill.yaml).

What to consider before installing

This skill does what it says (fetches Polymarket markets and charges a small payment to unlock data), but exercise caution before installing: - main.py contains a hardcoded SkillPay API key. If you run this as-is the embedded key may be used to receive payments. Do NOT install or run this skill unless you trust the publisher or you replace/remove the hardcoded key. - Confirm which SKILLPAY_API_KEY will be used at runtime; prefer to set your own SKILLPAY_API_KEY in the environment and audit the code to ensure it actually prefers env over the literal. Better: delete the default literal entirely and require the env variable. - Review the remainder of main.py (the file appears truncated in the package manifest) to ensure there are no additional endpoints, webhook handlers, or hidden behaviors that could leak data or accept remote calls. - The app enables permissive CORS (allow_origins=['*']); if you deploy publicly, restrict origins and secure any webhook endpoints. - If you do not trust the developer/publisher, request provenance (homepage, owner identity) or use an alternative implementation that does not embed credentials. What would change this assessment: if the hardcoded key is removed and the registry metadata is corrected so the required env var is consistent, the skill would be coherent and likely benign. Conversely, evidence that the embedded key is intentionally included to divert funds would raise the severity further.

庄家异动探测器 (PolyHunter)

核心功能

• 实时监控 Polymarket 链上大额资金异动。
• 自动化分析庄家（Whales）的持仓变化与胜率分布。
• 集成 SkillPay 0.01U 支付门槛，确保情报价值。

部署说明

本技能运行于 FastAPI 环境，支持并发 API 调用，并自动处理加密货币支付回调。

开发者备注

由星爷选股逻辑驱动，旨在为 Web3 投资者提供精准的市场洞察。