CB polymarket-trade

Trade on Polymarket prediction markets on Polygon. Supports browsing markets, checking wallet/CLOB balance, and buying or selling YES/NO shares with safety gates. Wallet: WDK vault (~/.aurehub/.wdk_vault). Config: ~/.aurehub/polymarket.yaml. Triggers: buy YES, buy NO, sell shares, browse markets, check Polymarket balance, Polymarket trade, prediction market, what are the odds, redeem winnings, claim resolved positions.

ClawHub Agent Skills author: aure-duncan v1.1.0 MIT-0 36 files body ≈ 2 335 tokens Open the sourceclawhub.ai↗ analyzed 4 d ago

As a process B 67/100 · Nearly there — weak spots: when it triggers, consistency, running it twice

Procedure Software developmenttype and topics are labelled automatically from the skill text

Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode

JSON

Technical rating

65/100

safety, quality, tests

Safety 60%: 53
Quality 40%: 83
Run on models: none yet

Process rating

67/100

Nearly there

When it triggers w 12: 20
Running it twice w 4: 30
Consistency w 8: 40

the three weakest of ten parameters · all ten

What is at stake

Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.

Exfiltration medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".

For the author

If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.

How to improve

Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.

For the model run — optional

Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 43

✓ No critical or high findings

Medium and low: 43

medium Exfiltration net-credential-use scripts/browse.js:152

Credential used in a network call (verify the destination is the intended service)
```
const res = await axios.get(`${clobUrl}/book?token_id=${tokenId}`, { timeout: 10_000 });
```
low Secrets in code secret-high-entropy-token config.example.yaml:17

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
usdc_e: "0x27…174"
```
fixturequoted
low Secrets in code secret-high-entropy-token config.example.yaml:18

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
ctf_exchange: "0x4b…82E"
```
fixturequoted
low Secrets in code secret-high-entropy-token config.example.yaml:19

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
neg_risk_exchange: "0xC5…80a"
```
fixturequoted
low Secrets in code secret-high-entropy-token config.example.yaml:20

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
ctf_contract: "0x4D…045"
```
fixturequoted
low Secrets in code secret-high-entropy-token config.example.yaml:21

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
uniswap_router: "0xE5…564"   # Uniswap V3 SwapRouter on Polygon
```
fixturequoted
low Secrets in code secret-high-entropy-token references/contracts.md:6

High-entropy token-like string (may be an id, hash or a credential)
```
0x27…174
```
low Secrets in code secret-high-entropy-token references/contracts.md:13

High-entropy token-like string (may be an id, hash or a credential)
```
0x4b…82E
```
low Secrets in code secret-high-entropy-token references/contracts.md:22

High-entropy token-like string (may be an id, hash or a credential)
```
0xC5…80a
```
low Secrets in code secret-high-entropy-token references/contracts.md:31

High-entropy token-like string (may be an id, hash or a credential)
```
0x4D…045
```
low Secrets in code secret-high-entropy-token scripts/__tests__/buy-dry-run.test.js:100

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
ctf_exchange:      '0x4b…82E',
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/buy-dry-run.test.js:101

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
neg_risk_exchange: '0xC5…80a',
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/buy-dry-run.test.js:102

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
usdc_e:            '0x27…174',
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/redeem.test.js:48

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
usdc_e: '0x27…174',
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/redeem.test.js:49

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
ctf_contract: '0x4D…045',
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/redeem.test.js:251

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
'0x27…174', // usdceAddr
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/redeem.test.js:383

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
usdc_e: '0x27…174',
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/sell.test.js:150

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
ctf_contract:      '0x4D…045',
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/sell.test.js:151

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
ctf_exchange:      '0x4b…82E',
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/sell.test.js:152

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
neg_risk_exchange: '0xC5…80a',
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/swap.test.js:51

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
'0x0d…270', // WMATIC
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/swap.test.js:52

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
'0x27…174', // USDC.e
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/__tests__/swap.test.js:90

High-entropy token-like string (may be an id, hash or a credential) (test fixture / example file; quoted — discussed, not commanded)
```
address: '0x27…174',
```
fixturequoted
low Secrets in code secret-high-entropy-token scripts/balance.js:36

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
const usdceAddr = contracts.usdc_e ?? '0x27…174';
```
quoted
low Secrets in code secret-high-entropy-token scripts/lib/swap.js:4

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
const WMATIC  = '0x0d…270';
```
quoted
low Secrets in code secret-high-entropy-token scripts/lib/swap.js:5

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
const USDC_E  = '0x27…174';
```
quoted
low Secrets in code secret-high-entropy-token scripts/lib/swap.js:6

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
const DEFAULT_QUOTER = '0xb2…AB6';
```
quoted
low Secrets in code secret-high-entropy-token scripts/lib/swap.js:7

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
const DEFAULT_ROUTER = '0xE5…564';
```
quoted
low Secrets in code secret-high-entropy-token scripts/package-lock.json:141

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha512-GhH/abcC…hoN+uBNo…mU1+t8xT…EBA==",
```
detector
low Secrets in code secret-high-entropy-token scripts/package-lock.json:224

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…Z4v+DkGoC42/TS2ond+PARCxTJvgTFUNDZovyQ/uAQ4…g7A==",
```
detector
low Secrets in code secret-high-entropy-token scripts/package-lock.json:378

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…6I6+jvuq…Pqq+JZ0T…Rng==",
```
detector
low Secrets in code secret-high-entropy-token scripts/package-lock.json:398

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…GmY+zPPWTC+wQrp…jmH+yCS3…njA==",
```
detector
low Secrets in code secret-high-entropy-token scripts/package-lock.json:472

High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
```
"integrity": "sha5…zbE+oCZYyY+3Zh8…sCw==",
```
detector
low Secrets in code secret-high-entropy-token scripts/redeem.js:92

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
const usdceAddr = contracts.usdc_e   ?? '0x27…174';
```
quoted
low Secrets in code secret-high-entropy-token scripts/redeem.js:93

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
const ctfAddr   = contracts.ctf_contract ?? '0x4D…045';
```
quoted
low Secrets in code secret-high-entropy-token scripts/trade.js:125

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
? (contracts.neg_risk_exchange ?? '0xC5…80a')
```
quoted
low Secrets in code secret-high-entropy-token scripts/trade.js:126

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
: (contracts.ctf_exchange      ?? '0x4b…82E');
```
quoted
low Secrets in code secret-high-entropy-token scripts/trade.js:127

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
const usdceAddr = contracts.usdc_e ?? '0x27…174';
```
quoted
low Secrets in code secret-high-entropy-token scripts/trade.js:269

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
const ctfAddr = contracts.ctf_contract ?? '0x4D…045';
```
quoted
low Secrets in code secret-high-entropy-token scripts/trade.js:318

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
? (contracts.neg_risk_exchange ?? '0xC5…80a')
```
quoted
low Exfiltration read-dotenv SKILL.md:80

Reads a .env file
```
source ~/.aurehub/.env
```
low Exfiltration read-dotenv SKILL.md:96

Reads a .env file (detector / deny-list definition)
```
- Re-source env: `source ~/.aurehub/.env`
```
detector
low Secrets in code secret-high-entropy-token SKILL.md:184

High-entropy token-like string (may be an id, hash or a credential) (quoted — discussed, not commanded)
```
- **Settlement currency**: USDC.e (bridged USDC, `0x27…174`)
```
quoted

Files scanned: 36. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

warning description-no-when description does not say WHEN to use the skill (no "use when")

Process rating: all ten parameters 67/100

20When it triggers. No condition that starts the skill
30Running it twice. 3 mutating operations with no state check
40Consistency. Frontmatter name (polymarket-trade) differs from the folder (aurehub-polymarket-trade)
60Tools and files. Uses tools (bash, node) that frontmatter does not declare
60Result and completion. Output format stated, no completion criterion
70Inputs and preconditions. Inputs and preconditions are listed
100Steps. 43 steps
100Failures and branches. 8 branches, has a failure section
100Execution cost. Instruction body is 2335 tokens
100Progress reporting. Reports progress

medium Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
low 14 top-level sections: this looks like several domains in one skill
low The response is described with custom markup (14 tags): a typed call is more reliable

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

+5Description has no quoted example phrases that should trigger the skill
+4Description does not say when NOT to use the skill (false activations)
+2Single-language instructions
+3Description length 422: enough signal without eating the budget
+4Structure: 16 headings
+3Step-by-step instructions: 43 items
+3Output format is stated explicitly
+4Has examples (6 code blocks)
+4Reference files are cited in the instructions (7 of 7)
+3All 5 scripts are documented
+1License stated

Quality base 70; lint remarks subtract, signals add up to 100. Result: 83.

External checks

ClawHub: suspicious

This is mostly a real Polymarket trading skill, but it includes under-disclosed wallet-related registration to an unrelated rankings service and automatic setup behaviors users should review first.

LLM: suspicious (high) · VirusTotal: · 29 May 2026

Tests

— no evals.json

— no spec.yaml

— not run on models

Files · 36

README.md 3K
SKILL.md 10K
SKILL.tests.yaml 6K
config.example.yaml 1K
references/balance.md 1K
references/browse.md 1K
references/buy.md 1K
references/contracts.md 1K
references/safety.md 1K
references/sell.md 1K
references/setup.md 1K
scripts/__tests__/balance.test.js 3K
scripts/__tests__/browse.test.js 12K
scripts/__tests__/buy-dry-run.test.js 6K
scripts/__tests__/clob.test.js 3K
scripts/__tests__/config.test.js 2K
scripts/__tests__/gas.test.js 2K
scripts/__tests__/redeem.test.js 15K
scripts/__tests__/sell.test.js 19K
scripts/__tests__/setup.test.js 3K
scripts/__tests__/signer.test.js 3K
scripts/__tests__/swap.test.js 5K
scripts/__tests__/trade.test.js 6K
scripts/balance.js 4K
scripts/browse.js 12K
scripts/lib/clob.js 2K
scripts/lib/config.js 2K
scripts/lib/gas.js 1K
scripts/lib/prompt.js 1K
scripts/lib/signer.js 4K
scripts/lib/swap.js 5K
scripts/package-lock.json 100K
scripts/package.json 1K
scripts/redeem.js 8K
scripts/setup.js 7K
scripts/trade.js 21K

Frontmatter

license: MIT

compatibility: Requires Node.js >= 18, Polygon RPC (HTTPS), and Polymarket CLOB API credentials.

metadata: {"author":"aurehub","version":"1.1.0"}

Dates

In catalog since 26 Mar 2026

Updated in catalog 18 May 2026

First seen here 11 Sept 2026

Last analysis 11 Sept 2026, 08:40 UTC

Last seen in crawl 35 h ago

Score history

Date		Score	Safety	Qual.
11 Sept 2026	C	65	53	83

Similar skills

B polymarket-trade ClawHub