polymarket-mcp-server

SUSPICIOUS. The skill’s trading purpose matches its wallet requirements, but the trust model is poor: ara.so branding points users to an unrelated personal GitHub repo, installs rely on unpinned shell scripts, and wallet private keys are forwarded into third-party code that can autonomously place trades. This is a high security-risk skill even without proof of explicit exfiltration.