polymarket-openclaw-ai-trading-bot
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to clone a repository from an external GitHub account (
Predictly-MCP-Labs/polymarket-openclaw-ai-btc-arbitrage-trading-bot) as part of the installation process. - [INDIRECT_PROMPT_INJECTION]: The trading bot ingests external market data and optional decision signals, which constitutes a potential surface for indirect injection if that data were used to influence agent instructions.
- Ingestion points: Fetches market data from the Polymarket Gamma API and receives trading decisions from an optional user-configured OpenClaw HTTP service.
- Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the provided snippets.
- Capability inventory: The bot is capable of executing financial transactions (market orders) on the Polymarket CLOB and performing network requests to external APIs.
- Sanitization: The provided code samples demonstrate numeric processing of price data and basis points, which naturally limits the risk of traditional prompt-based injections.
Audit Metadata