polymarket-fast-loop
Warn
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: MEDIUMNO_CODECOMMAND_EXECUTIONCREDENTIALS_UNSAFEPROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill documentation refers to a core execution script (fastloop_trader.py) which is absent from the provided source files, preventing a security audit of the implementation.
- [COMMAND_EXECUTION]: The skill provides commands for the agent to execute unvetted external scripts and establish persistence via system crontab and OpenClaw cron jobs.
- [CREDENTIALS_UNSAFE]: Setup instructions prompt the user to store a highly sensitive WALLET_PRIVATE_KEY in environment variables, which is a high-risk practice for credential exposure in an AI context.
- [PROMPT_INJECTION]: The skill ingests untrusted data from the Polymarket Gamma API and Binance API to drive trading logic. Ingestion points: External market and price APIs. Boundary markers: Absent. Capability inventory: Order signing and execution on Polymarket. Sanitization: None documented. This creates a surface for indirect prompt injection.
Audit Metadata