polymarket-openclaw-trading-bot

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill instructs the user to put a wallet private key in .env and includes code that derives and console.logs the API key (console.log("API Key:", apiCreds.apiKey)), which forces secret values to be output verbatim and is an exfiltration risk.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a trading bot that performs on-chain/market transactions. It requires a Polygon wallet private key and USDC balance, derives/creates API credentials, initializes a Polymarket CLOB trading client, and calls functions to create/post market orders (clobClient.createMarketOrder / clobClient.postOrder). It includes buy/sell order methods, order retries, emergency swaps, and balance validation. These are specific crypto/market order execution capabilities (direct financial execution).