polymarket-openclaw-ai-arbitrage-bot
Fail
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to clone code from an unverified external repository at
https://github.com/lorine93s/openclaw-polymarket-ai-arbitrage-trading-bot. This repository is not associated with a trusted organization or well-known service. - [REMOTE_CODE_EXECUTION]: After cloning the unverified repository, the skill directs the agent to execute
npm installandnpm start. This pattern allows for arbitrary code execution from an untrusted source, which could include malicious pre-install or post-install scripts. - [CREDENTIALS_UNSAFE]: The skill requires the use of a
POLYMARKET_PRIVATE_KEYfor a blockchain wallet. While it includes warnings against committing this key to version control, it also provides a trigger for 'debug polymarket api credentials'. This creates a significant risk that the agent may reveal the raw private key in its output or logs while attempting to troubleshoot configuration issues.
Recommendations
- AI detected serious security threats
Audit Metadata