polymarket-openclaw-trading-bot

SUSPICIOUS. The core capabilities fit the stated purpose of a Polymarket trading bot, but the trust chain is weaker than ideal because the skill is published by ara.so while directing users to clone and run code from a different GitHub owner. The requested wallet private key is proportionate to blockchain trading, yet this skill enables autonomous real-money trading and also exposes derived API credentials in logs. No clear credential-harvesting or overt exfiltration is present in the provided text, but the combination of third-party code execution, private-key use, optional external HTTP decision routing, and financial autonomy makes this a high security-risk skill even without confirmed malware.