polymarket-arbitrage-bot

SUSPICIOUS. The skill’s trading behavior and credential needs are broadly consistent with its stated purpose, and its API data flows point to official Polymarket endpoints, not obvious exfiltration infrastructure. However, install trust is weakened because the referenced GitHub source could not be verified and the publisher/source relationship is unclear, while the skill also enables autonomous real-money trading with a raw private key. Not confirmed malware, but risky enough to treat with caution.