Skills polymarket
📦

polymarket

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Build Polymarket Market Data Integrations

Prediction market apps need accurate API, trading, and live data guidance. This skill helps Claude, Codex, and Claude Code use Polymarket references for REST endpoints, CLOB workflows, and WebSocket streams.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "polymarket" from https://skillstore.io/skills/2025emma-polymarket.md and its manifest at https://skillstore.io/api/skills/2025emma-polymarket/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/2025emma-polymarket.md Signed manifest GET /api/skills/2025emma-polymarket/manifest Signed lockfile GET /api/skills/2025emma-polymarket/lockfile

Test it

Using "polymarket". Show me how to monitor trades for a Polymarket event.

Expected outcome:

  • Identify the event or market slug first.
  • Use the activity topic with the trades type.
  • Apply a market or event filter to reduce message volume.
  • Handle reconnects and validate message payloads before storing them.

Using "polymarket". Explain how API keys relate to private keys.

Expected outcome:

Private keys sign high-trust actions and can derive API credentials. API credentials should be stored separately and never printed or shared.

Using "polymarket". Review my plan to cancel open orders in production.

Expected outcome:

  • Require explicit user confirmation before any cancel-all action.
  • Log the target account, market, and expected order count before execution.
  • Prefer market-scoped cancellation when possible.

Security Audit

High Risk
v7 • 7/4/2026 Open versioned report

Most static alerts are false positives caused by Markdown backticks, relative documentation links, and normal Polymarket URLs. I confirmed the findings that involve private keys, API credentials, .env loading, and credentialed trading examples because an agent could mishandle secrets or account-changing calls. No prompt-injection attempts were found in the reviewed files.

12
Files scanned
10,324
Lines analyzed
20
Review items
0
False positives ignored

Confirmed security concerns (26)

High
references/learn.md:13
Crypto seed/private key mention
Exporting your private key on Magic.Link
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/learn.md:15
Crypto seed/private key mention
Exporting your private key gives you direct control and security over your funds. This process is ap
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/learn.md:25
Crypto seed/private key mention
3. Export Private Key. Once revealed, you should securely store the private key displayed, where oth
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/learn.md:391
Crypto seed/private key mention
A private key acts like a highly secure password, essential for managing and moving your assets with
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:1418
Environment file access
dotenvConfig({ path: resolve(__dirname, "../.env") });
The example accesses .env-backed private key or Polymarket API credential values. These secrets can control funds or authenticated trading operations.
High
references/llms-full.md:1421
Environment file access
const wallet = new ethers.Wallet(`${process.env.PK}`);
The example accesses .env-backed private key or Polymarket API credential values. These secrets can control funds or authenticated trading operations.
High
references/llms-full.md:1425
Environment file access
const host = process.env.CLOB_API_URL || "https://clob.polymarket.com";
The example allows the authenticated CLOB host to be configured through the environment. This is legitimate configuration but can misroute credentialed requests if unsafe.
High
references/llms-full.md:1427
Environment file access
key: `${process.env.CLOB_API_KEY}`,
The example accesses .env-backed private key or Polymarket API credential values. These secrets can control funds or authenticated trading operations.
Show all 26 confirmed findings
High
references/llms-full.md:1428
Environment file access
secret: `${process.env.CLOB_SECRET}`,
The example accesses .env-backed private key or Polymarket API credential values. These secrets can control funds or authenticated trading operations.
High
references/llms-full.md:1429
Environment file access
passphrase: `${process.env.CLOB_PASS_PHRASE}`,
The example accesses .env-backed private key or Polymarket API credential values. These secrets can control funds or authenticated trading operations.
High
references/llms-full.md:386
Crypto seed/private key mention
## L1: Private Key Authentication
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:388
Crypto seed/private key mention
The highest level of authentication is via an account’s Polygon private key.\
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:389
Crypto seed/private key mention
The private key remains in control of a user’s funds and all trading is non-custodial.\
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:392
Crypto seed/private key mention
Private key authentication is required for:
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:627
Crypto seed/private key mention
const signer = new Wallet(""); //This is your Private Key. If using email login export from https://
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:1106
Crypto seed/private key mention
key: str = "" #This is your Private Key. Export from reveal.polymarket.com or from your Web3 Applica
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:1365
Crypto seed/private key mention
key: str = "" ##This is your Private Key. Export from https://reveal.magic.link/polymarket or from y
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:3310
Crypto seed/private key mention
Exporting your private key on Magic.Link
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:3312
Crypto seed/private key mention
Exporting your private key gives you direct control and security over your funds. This process is ap
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:3322
Crypto seed/private key mention
3. Export Private Key. Once revealed, you should securely store the private key displayed, where oth
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:3338
Crypto seed/private key mention
A private key acts like a highly secure password, essential for managing and moving your assets with
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:4660
Crypto seed/private key mention
key: str = "" #This is your Private Key. Export from https://reveal.magic.link/polymarket or from yo
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:4705
Crypto seed/private key mention
const signer = new Wallet(""); //This is your Private Key. If using email login export from https://
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:4767
Crypto seed/private key mention
key: str = "" #This is your Private Key. If using email login export from https://reveal.magic.link/
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/llms-full.md:4794
Crypto seed/private key mention
const signer = new Wallet("YourPrivateKey"); //This is your Private Key. If using email login export
The documentation instructs users to export, handle, or place a private key into trading client code. This is expected for the workflow but high-risk because the key controls funds.
High
references/trading.md:311-322references/llms-full.md:849-857
Destructive Trading Operation Example
The references include cancel-all trading endpoints and runnable examples that cancel all open orders. This is legitimate functionality, but it can cause financial impact if an agent runs it without explicit user approval.
The cited lines directly describe cancel-all behavior and show calls that cancel all user orders. Static analysis did not capture this business-logic side effect.
Capability review items (20)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
references/llms-full.md:1418
Hidden file access
dotenvConfig({ path: resolve(__dirname, "../.env") });
The example explicitly loads a parent .env file, which commonly stores trading private keys and API credentials. In an agent context this can expose local secrets if run without consent.
High
references/llms-full.md:1421
Environment variable access (dot notation)
const wallet = new ethers.Wallet(`${process.env.PK}`);
The example reads private key or API credential values from environment variables for an authenticated trading client. These secrets can authorize account and trading actions if mishandled.
High
references/llms-full.md:1427
Environment variable access (dot notation)
key: `${process.env.CLOB_API_KEY}`,
The example reads private key or API credential values from environment variables for an authenticated trading client. These secrets can authorize account and trading actions if mishandled.
High
references/llms-full.md:1428
Environment variable access (dot notation)
secret: `${process.env.CLOB_SECRET}`,
The example reads private key or API credential values from environment variables for an authenticated trading client. These secrets can authorize account and trading actions if mishandled.
High
references/llms-full.md:1429
Environment variable access (dot notation)
passphrase: `${process.env.CLOB_PASS_PHRASE}`,
The example reads private key or API credential values from environment variables for an authenticated trading client. These secrets can authorize account and trading actions if mishandled.
High
references/llms-full.md:1421
Environment variable object
const wallet = new ethers.Wallet(`${process.env.PK}`);
The example reads private key or API credential values from environment variables for an authenticated trading client. These secrets can authorize account and trading actions if mishandled.
High
references/llms-full.md:1427
Environment variable object
key: `${process.env.CLOB_API_KEY}`,
The example reads private key or API credential values from environment variables for an authenticated trading client. These secrets can authorize account and trading actions if mishandled.
High
references/llms-full.md:1428
Environment variable object
secret: `${process.env.CLOB_SECRET}`,
The example reads private key or API credential values from environment variables for an authenticated trading client. These secrets can authorize account and trading actions if mishandled.
High
references/llms-full.md:1429
Environment variable object
passphrase: `${process.env.CLOB_PASS_PHRASE}`,
The example reads private key or API credential values from environment variables for an authenticated trading client. These secrets can authorize account and trading actions if mishandled.
High
references/llms-full.md:1418
dotenv library
dotenvConfig({ path: resolve(__dirname, "../.env") });
The example loads a .env file before constructing an authenticated trading client. That file may contain private keys and Polymarket API credentials.
High
references/llms-full.md:498
Generic API/secret keys
| `POLY_API_KEY` | yes | Polymarket API key |
The documentation names, stores, or prints API keys, secrets, or passphrases for authenticated Polymarket access. Disclosure of these values can authorize trading or account actions.
High
references/llms-full.md:1427
Generic API/secret keys
key: `${process.env.CLOB_API_KEY}`,
The documentation names, stores, or prints API keys, secrets, or passphrases for authenticated Polymarket access. Disclosure of these values can authorize trading or account actions.
High
references/llms-full.md:2746
Generic API/secret keys
"key": "api_key",
The documentation names, stores, or prints API keys, secrets, or passphrases for authenticated Polymarket access. Disclosure of these values can authorize trading or account actions.
High
references/llms-full.md:2747
Generic API/secret keys
"secret": "api_secret",
The documentation names, stores, or prints API keys, secrets, or passphrases for authenticated Polymarket access. Disclosure of these values can authorize trading or account actions.
High
references/llms-full.md:4782
Generic API/secret keys
print( client.derive_api_key() )
The documentation names, stores, or prints API keys, secrets, or passphrases for authenticated Polymarket access. Disclosure of these values can authorize trading or account actions.
High
references/llms-full.md:4877
Generic API/secret keys
api_key = ""
The documentation names, stores, or prints API keys, secrets, or passphrases for authenticated Polymarket access. Disclosure of these values can authorize trading or account actions.
High
references/llms-full.md:4878
Generic API/secret keys
api_secret = ""
The documentation names, stores, or prints API keys, secrets, or passphrases for authenticated Polymarket access. Disclosure of these values can authorize trading or account actions.
High
references/llms-full.md:4886
Generic API/secret keys
auth = {"apiKey": api_key, "secret": api_secret, "passphrase": api_passphrase}
The documentation names, stores, or prints API keys, secrets, or passphrases for authenticated Polymarket access. Disclosure of these values can authorize trading or account actions.
Medium
references/llms-full.md:1425
Environment variable access (dot notation)
const host = process.env.CLOB_API_URL || "https://clob.polymarket.com";
The credentialed CLOB client can take its API host from the environment. A malicious or mistaken endpoint could receive authenticated trading requests.
Medium
references/llms-full.md:1425
Environment variable object
const host = process.env.CLOB_API_URL || "https://clob.polymarket.com";
The credentialed CLOB client can take its API host from the environment. A malicious or mistaken endpoint could receive authenticated trading requests.

Risk Factors

⚙️ External commands (93)
references/api.md:190-227 references/api.md:227-238 references/api.md:334-344 references/api.md:344-369 references/api.md:369-370 references/api.md:370 references/api.md:376 references/llms-full.md:784-787 references/llms-full.md:825-828 references/llms-full.md:859-863 references/llms-full.md:907-910 references/llms-full.md:1421-1422 references/llms-full.md:1422-1423 references/llms-full.md:1423-1427 references/llms-full.md:1427-1428 references/llms-full.md:1428-1429 references/llms-full.md:1429-1481 references/llms-full.md:1540-1543 references/llms-full.md:1761-1766 references/other.md:127-128 references/other.md:128-129 references/other.md:129-130 references/other.md:130-137 references/other.md:260-264 references/other.md:264-265 references/other.md:265-268 references/other.md:268 references/other.md:286-287 references/other.md:422-423 references/other.md:423-424 references/other.md:424-425 references/other.md:425-426 references/other.md:426-427 references/other.md:427-428 references/other.md:428-429 references/other.md:429-430 references/other.md:430-431 references/other.md:431-432 references/other.md:432-438 references/other.md:438-439 references/other.md:439-440 references/other.md:440-441 references/other.md:441-442 references/other.md:442-448 references/other.md:448-449 references/other.md:449-455 references/README.md:24-31 references/realtime-client.md:24-31 references/trading.md:705-716 SKILL.md:34-36 SKILL.md:36-39 SKILL.md:39-56 SKILL.md:56-60 SKILL.md:60-61 SKILL.md:61-62 SKILL.md:62-63 SKILL.md:63 SKILL.md:65-66 SKILL.md:66 SKILL.md:67 SKILL.md:68-70 SKILL.md:70-74 SKILL.md:74 SKILL.md:75-76 SKILL.md:76-78 SKILL.md:78-79 SKILL.md:79-80 SKILL.md:80-82 SKILL.md:82-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-86 SKILL.md:86 SKILL.md:90-102 SKILL.md:102-107 SKILL.md:107-112 SKILL.md:112-115 SKILL.md:115-118 SKILL.md:118-123 SKILL.md:123-126 SKILL.md:126-129 SKILL.md:129-134 SKILL.md:134-137 SKILL.md:137-141 SKILL.md:141-156 SKILL.md:156-179 SKILL.md:179-181 SKILL.md:181-185 SKILL.md:185-211 SKILL.md:211-214 SKILL.md:214 SKILL.md:217-220 SKILL.md:220
🌐 Network access (63)
references/api.md:293 references/api.md:303 references/api.md:313 references/api.md:414 references/api.md:424 references/api.md:434 references/api.md:445 references/api.md:455 references/api.md:465 references/api.md:476 references/api.md:487 references/api.md:498 references/api.md:508 references/api.md:519 references/api.md:529 references/api.md:539 references/api.md:550 references/api.md:560 references/api.md:571 references/api.md:581 references/api.md:591 references/api.md:601 references/api.md:611 references/api.md:622 references/api.md:630 references/api.md:640 references/api.md:650 references/guides.md:61 references/guides.md:128 references/guides.md:205 references/guides.md:209 references/guides.md:213 references/llms-full.md:2821 references/llms-full.md:625 references/llms-full.md:627 references/llms-full.md:1105 references/llms-full.md:1123 references/llms-full.md:1364 references/llms-full.md:1365 references/llms-full.md:1382 references/llms-full.md:1425 references/llms-full.md:2798 references/llms-full.md:2812 references/llms-full.md:2840 references/llms-full.md:2874 references/llms-full.md:2890 references/llms-full.md:2895 references/llms-full.md:2900 references/llms-full.md:2905 references/llms-full.md:2910 references/llms-full.md:4659 references/llms-full.md:4660 references/llms-full.md:4677 references/llms-full.md:4703 references/llms-full.md:4705 references/llms-full.md:4720 references/llms-full.md:4727 references/llms-full.md:4766 references/llms-full.md:4767 references/llms-full.md:4793 references/llms-full.md:4794 SKILL.md:204 SKILL.md:205
📁 Filesystem access (39)
references/getting_started.md:332 references/getting_started.md:334 references/getting_started.md:336 references/guides.md:203 references/guides.md:233 references/learn.md:110 references/learn.md:391 references/learn.md:487 references/learn.md:495 references/learn.md:499 references/learn.md:634 references/learn.md:638 references/learn.md:869 references/learn.md:898 references/learn.md:958 references/learn.md:1376 references/llms-full.md:1416 references/llms-full.md:1418 references/llms-full.md:3338 references/llms-full.md:3809 references/llms-full.md:3817 references/llms-full.md:3821 references/llms-full.md:3900 references/llms-full.md:3933 references/llms-full.md:3949 references/llms-full.md:3951 references/llms-full.md:3953 references/llms-full.md:4094 references/llms-full.md:4152 references/llms-full.md:4233 references/llms-full.md:4401 references/llms-full.md:4433 references/llms-full.md:4451 references/llms-full.md:4455 references/llms-full.md:1418 references/README.md:10 references/README.md:11 references/realtime-client.md:10 references/realtime-client.md:11
🔑 Env variables (22)
references/llms-full.md:1421 references/llms-full.md:1422 references/llms-full.md:1425 references/llms-full.md:1427 references/llms-full.md:1428 references/llms-full.md:1429 references/llms-full.md:1421 references/llms-full.md:1422 references/llms-full.md:1425 references/llms-full.md:1427 references/llms-full.md:1428 references/llms-full.md:1429 references/llms-full.md:1414 references/llms-full.md:1418 references/llms-full.md:498 references/llms-full.md:1427 references/llms-full.md:2746 references/llms-full.md:2747 references/llms-full.md:4782 references/llms-full.md:4877 references/llms-full.md:4878 references/llms-full.md:4886
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/2025emma-polymarket/audits/7?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/2025emma-polymarket/security.svg)](https://skillstore.io/skills/2025emma-polymarket?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/2025emma-polymarket?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/2025emma-polymarket/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/2025emma-polymarket.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

2025Emma. (2026). polymarket security audit report (audit version 7) [Author version unspecified]. Skillstore. https://skillstore.io/skills/2025emma-polymarket/audits/7

BibTeX citation

@techreport{2025emma-2025emma-polymarket-2026, author = {2025Emma}, title = {polymarket security audit report (audit version 7)}, institution = {Skillstore}, year = {2026}, number = {7}, url = {https://skillstore.io/skills/2025emma-polymarket/audits/7}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "polymarket security audit report (audit version 7)" version: "unspecified" type: report authors: - name: "2025Emma" date-released: "2026-07-04" url: "https://skillstore.io/skills/2025emma-polymarket/audits/7" identifiers: - type: other value: "skillstore:2025emma-polymarket:audit:7" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Build a live market monitor

Create a service that follows trades, comments, prices, and market updates through Polymarket WebSocket topics.

Research prediction market data

Find endpoints for events, markets, tags, order books, price history, and user positions.

Prototype trading workflows

Review CLOB authentication, order creation, cancellation, and rate limits before implementing authenticated trading.

Try These Prompts

Find Market Data Endpoints 
Use this skill to find the Polymarket endpoints for markets, events, tags, and price history. Summarize required parameters and limits.
Plan a WebSocket Stream 
Use this skill to design a Polymarket WebSocket subscription plan for trades, comments, and price changes for one event.
Design a CLOB Workflow 
Use this skill to outline a CLOB workflow for authentication, order creation, balance checks, and cancellation. Include safety checkpoints.
Review Trading Integration Risk 
Use this skill to review a Polymarket trading integration for credential handling, rate limits, market order risk, and explicit user confirmations.

Best Practices

  • Use read-only market data endpoints before adding authenticated trading.
  • Keep private keys and API secrets outside prompts, logs, and shared files.
  • Confirm account, market, size, side, and price before any trading action.

Avoid

  • Do not ask an agent to reveal, export, or print private keys.
  • Do not run cancel-all or market-order examples without explicit approval.
  • Do not subscribe to broad streams when filtered subscriptions are available.

Frequently Asked Questions

What does this skill help build?
It helps build Polymarket data tools, WebSocket monitors, and CLOB trading integrations.
Does it place trades by itself?
No. It provides guidance and examples. Trading requires separate user credentials and explicit execution.
Can it use real-time market data?
Yes. It documents WebSocket topics for trades, comments, RFQ, market updates, and crypto prices.
Does it require private keys?
Read-only workflows do not require private keys. Authenticated trading workflows may require private keys or API credentials.
Is this financial advice?
No. The skill explains technical integration patterns and does not recommend trades or predict outcomes.
Which AI tools are supported?
The report lists support for Claude, Codex, and Claude Code.

Developer Details

Author

2025Emma

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/2025Emma/vibe-coding-cn/tree/main/i18n/zh/skills/polymarket

Ref

e9e4712298ed071d92417a41714be123eb8364fa

Maintenance freshness

7/18/2026

Usage

22 downloads · 227 views

File structure

📁 references/

📄 api.md

📄 getting_started.md

📄 guides.md

📄 index.md

📄 learn.md

📄 llms-full.md

📄 llms.md

📄 other.md

📄 README.md

📄 realtime-client.md

📄 trading.md

📄 SKILL.md