The Agent Skills Directory

[SAFE]: The skill handles sensitive user credentials, such as the POLYMARKET_PRIVATE_KEY, using secure local storage practices. Credentials are saved in individual JSON files with filesystem permissions restricted to the owner (chmod 0o600), preventing unauthorized access by other system users.
[COMMAND_EXECUTION]: The skill uses subprocess.run to orchestrate internal logic, such as calling its own CLI tools or sending user notifications via the openclaw utility. These executions use structured argument lists rather than shell strings, effectively preventing shell injection vulnerabilities.
[PROMPT_INJECTION]: The skill monitors external market data from the Polymarket Gamma API. While market titles and questions are untrusted strings that could potentially contain instructions intended to manipulate an AI agent (Indirect Prompt Injection), the skill treats this data as informational output and does not grant the external content any control over the execution flow.

polymarket-trading