Is ceeyang/polymarket-odds-1-0-0 safe?
Use with caution. ceeyang/polymarket-odds-1-0-0 is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the polymarket-odds-1-0-0 skill by ceeyang a trust score of 76/100 with 3 findings (1 high).
https://github.com/openclaw/skills/tree/main/skills/ceeyang/polymarket-odds-1-0-0
Is ceeyang/polymarket-odds-1-0-0 safe to install?
This Polymarket CLI skill appears functionally legitimate based on its documentation, but suffers from critical transparency issues. The main executable source code is missing from the audit, making full security verification impossible.
What security issues were found in ceeyang/polymarket-odds-1-0-0?
Category Scores
Findings (3)
HIGH Missing Source Code Transparency -40 ▶
The main executable file 'polymarket.mjs' content is not provided in the audit evidence, making it impossible to verify what code would be executed. This is a critical security concern for any executable skill.
MEDIUM Sensitive File Access During Installation -25 ▶
Monitoring detected access to sensitive credential files including .env, SSH keys, AWS credentials, and other config files. While files were not modified, the access itself is concerning.
LOW Canary File Access Without Modification -10 ▶
Honeypot credential files were accessed but not modified or exfiltrated, indicating potential reconnaissance behavior from system processes rather than the skill itself.
Should I install ceeyang/polymarket-odds-1-0-0?
Oathe's verdict for ceeyang/polymarket-odds-1-0-0 is CAUTION with a trust score of 76/100. Recommendation: Review before install.