跳到主要内容
知仓学习社ZHICANG

polyclaw

Trade on Polymarket via split + CLOB execution. Browse markets, track positions with P&L, discover hedges via LLM. Polygon/Web3.

读凭据执行命令联网严重 11 · 高危 12chainstacklabs/polyclaw

它会碰到什么

扫了多少20 个文本文件,135 KB
它会碰到什么读凭据执行命令联网
命中总数43 处
命中统计严重 11 · 高 12 · 中 13 · 低 7
逐条看命中(23 条严重或高危)
  • 严重 scripts/hedge.py:20cred-paths
    # Load .env file from skill root directory
  • 严重 scripts/hedge.py:22cred-paths
    load_dotenv(Path(__file__).parent.parent / ".env")
  • 严重 scripts/polyclaw.py:24cred-paths
    # Load .env file from skill root directory (for OpenClaw env var injection)
  • 严重 scripts/polyclaw.py:27cred-paths
    load_dotenv(SKILL_DIR / ".env")
  • 严重 scripts/positions.py:15cred-paths
    # Load .env file from skill root directory
  • 严重 scripts/positions.py:17cred-paths
    load_dotenv(Path(__file__).parent.parent / ".env")
  • 严重 scripts/redeem.py:29cred-paths
    load_dotenv(Path(__file__).parent.parent / ".env")
  • 严重 scripts/trade.py:18cred-paths
    # Load .env file from skill root directory
  • 严重 scripts/trade.py:20cred-paths
    load_dotenv(Path(__file__).parent.parent / ".env")
  • 严重 scripts/wallet.py:12cred-paths
    # Load .env file from skill root directory
  • 严重 scripts/wallet.py:14cred-paths
    load_dotenv(Path(__file__).parent.parent / ".env")
  • lib/clob_client.py:14cred-envread
    CLOB_MAX_RETRIES = int(os.environ.get("CLOB_MAX_RETRIES", "5"))
  • lib/clob_client.py:30cred-envread
    proxy = os.environ.get("HTTPS_PROXY") or os.environ.get("HTTP_PROXY")
  • lib/clob_client.py:30cred-envread
    proxy = os.environ.get("HTTPS_PROXY") or os.environ.get("HTTP_PROXY")
  • lib/clob_client.py:55cred-envread
    proxy = os.environ.get("HTTPS_PROXY") or os.environ.get("HTTP_PROXY")
  • lib/clob_client.py:55cred-envread
    proxy = os.environ.get("HTTPS_PROXY") or os.environ.get("HTTP_PROXY")
  • lib/clob_client.py:63cred-envread
    builder_code = os.environ.get("POLY_BUILDER_CODE", "").strip() or None
  • lib/clob_client.py:118cred-envread
    proxy = os.environ.get("HTTPS_PROXY") or os.environ.get("HTTP_PROXY")
  • lib/clob_client.py:118cred-envread
    proxy = os.environ.get("HTTPS_PROXY") or os.environ.get("HTTP_PROXY")
  • lib/llm_client.py:50cred-envread
    self.api_key = api_key or os.getenv("OPENROUTER_API_KEY")
  • lib/wallet_manager.py:25cred-envread
    self.rpc_url = rpc_url or os.environ.get("CHAINSTACK_NODE", "")
  • lib/wallet_manager.py:32cred-envread
    private_key = os.environ.get("POLYCLAW_PRIVATE_KEY")
  • scripts/polyclaw.py:41exec-spawn
    result = subprocess.run(cmd)

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

PolyClaw

Trading-enabled Polymarket skill for OpenClaw. Browse markets, manage wallets, execute trades, and track positions.

Features

  • Market Browsing - Search and browse Polymarket prediction markets
  • Wallet Management - Env-var based wallet configuration
  • Trading - Buy YES/NO positions via split + CLOB execution
  • Position Tracking - Track entry prices, current prices, and P&L
  • Hedge Discovery - LLM-powered covering portfolio discovery via logical implications

Quick Start

First, install dependencies (from skill directory):

cd {baseDir}
uv sync

First-Time Setup (Required for Trading)

Before your first trade, set Polymarket contract approvals (one-time, costs ~0.01 POL in gas):

uv run python scripts/polyclaw.py wallet approve

This submits 6 approval transactions to Polygon. You only need to do this once per wallet.

Browse Markets

# Trending markets by volume
uv run python scripts/polyclaw.py markets trending

# Search markets
uv run python scripts/polyclaw.py markets search "election"

# Market details (returns full JSON with all fields)
uv run python scripts/polyclaw.py market <market_id>

Output options:

  • Default output is a formatted table (good for display)
  • Use --full flag for full question text without truncation
  • Use --json flag via scripts/markets.py --json trending for structured JSON output

Wallet Management

# Check wallet status (address, balances)
uv run python scripts/polyclaw.py wallet status

# Set contract approvals (one-time)
uv run python scripts/polyclaw.py wallet approve

The wallet is configured via the POLYCLAW_PRIVATE_KEY environment variable.

Trading

# Buy YES position for $50
uv run python scripts/polyclaw.py buy <market_id> YES 50

# Buy NO position for $25
uv run python scripts/polyclaw.py buy <market_id> NO 25

Positions

# List all positions with P&L
uv run python scripts/polyclaw.py positions

Hedge Discovery

Find covering portfolios - pairs of market positions that hedge each other via contrapositive logic.

# Scan trending markets for hedges
uv run python scripts/polyclaw.py hedge scan

# Scan markets matching a query
uv run python scripts/polyclaw.py hedge scan --query "election"

# Analyze specific markets for hedging relationship
uv run python scripts/polyclaw.py hedge analyze <market_id_1> <market_id_2>

Output options:

  • Default output is a formatted table showing Tier, Coverage, Cost, Target, and Cover
  • Use --json flag for structured JSON output
  • Use --min-coverage 0.90 to filter by minimum coverage (default 0.85)
  • Use --tier 1 to filter by tier (1=best, default 2)

Coverage tiers:

  • Tier 1 (HIGH): >=95% coverage - near-arbitrage opportunities
  • Tier 2 (GOOD): 90-95% - strong hedges
  • Tier 3 (MODERATE): 85-90% - decent but noticeable risk
  • Tier 4 (LOW): <85% - speculative (filtered by default)

LLM model: Uses nvidia/nemotron-nano-9b-v2:free via OpenRouter. Model selection matters — some models find spurious correlations while others (like DeepSeek R1) have output format issues. Override with --model <model_id> if needed.

Security

For the MVP, the private key is stored in an environment variable for simplicity and Claude Code compatibility.

Security Warning: Keep only small amounts in this wallet. Withdraw regularly to a secure wallet.

Environment Variables

| Variable | Required | Description |

|----------|----------|-------------|

| CHAINSTACK_NODE | Yes (trading) | Polygon RPC URL |

| OPENROUTER_API_KEY | Yes (hedge) | OpenRouter API key for LLM hedge discovery |

| POLYCLAW_PRIVATE_KEY | Yes (trading) | EVM private key (hex, with or without 0x prefix) |

| HTTPS_PROXY | Recommended | Rotating residential proxy for CLOB (e.g., IPRoyal) |

| CLOB_MAX_RETRIES | No | Max CLOB retries with IP rotation (default: 5) |

| POLY_BUILDER_CODE | No | Bytes32 builder code for attribution (from polymarket.com/settings?tab=builder). Attached to every order when set. |

Security Warning: Keep only small amounts in this wallet. Withdraw regularly to a secure wallet. The private key in an env var is convenient for automation but less secure than encrypted storage.

Trading Flow

  1. Split Position - pUSD is split into YES + NO tokens via CTF contract
  2. Sell Unwanted - The unwanted side is sold via CLOB order book (V2)
  3. Result - You hold the wanted position, recovered partial cost from selling unwanted

Example: Buy YES at $0.70

  • Split $100 pUSD → 100 YES + 100 NO tokens
  • Sell 100 NO tokens at ~$0.30 → recover ~$27 pUSD
  • Net cost: ~$73 for 100 YES tokens (entry: $0.73)

If you only have USDC.e, wrap it 1:1 into pUSD via the Collateral Onramp's wrap() function before trading.

Polymarket Contracts (Polygon Mainnet, CLOB V2)

  • pUSD (collateral): 0xC011a7E12a19f7B1f670d46F03B03f3342E82DFB
  • USDC.e (onramp input): 0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174
  • Collateral Onramp: 0x93070a847efEf7F70739046A929D47a521F5B8ee
  • CTF (Conditional Tokens): 0x4D97DCd97eC945f40cF65F87097ACe5EA0476045
  • CTF Exchange (V2): 0xE111180000d2663C0091e4f400237545B87B996B
  • Neg Risk CTF Exchange (V2): 0xe2222d279d744050d28e00520010520000310F59

Dependencies

Install with uv (from skill directory):

cd {baseDir}
uv sync

Limitations

  • Trading requires wallet approval setup (one-time)
  • CLOB sells may fail if liquidity is insufficient

CLOB Cloudflare Blocking

Polymarket's CLOB API uses Cloudflare protection that blocks POST requests from many IPs, including datacenter IPs and some residential ISPs. This affects the "sell unwanted tokens" step.

Solution: Residential proxy with retry logic

The recommended setup uses a rotating residential proxy (e.g., IPRoyal, BrightData). The CLOB client automatically retries with new IPs until one works:

export HTTPS_PROXY="http://user:pass@geo.iproyal.com:12321"
export CLOB_MAX_RETRIES=10  # Default is 5

With this setup, CLOB orders typically succeed within 5-10 retries as the proxy rotates through IPs until finding an unblocked one.

Alternative workarounds:

  1. Use --skip-sell — Keep both YES and NO tokens, sell manually on polymarket.com
  2. No proxy — Split still works; only CLOB sell is affected

If CLOB fails after all retries, your split still succeeded. The output tells you how many tokens to sell manually.

Troubleshooting

"No wallet available"

Set the POLYCLAW_PRIVATE_KEY environment variable:

export POLYCLAW_PRIVATE_KEY="0x..."

"Insufficient pUSD"

Check balance with uv run python scripts/polyclaw.py wallet status. Trades require pUSD (Polymarket USD). If you have USDC.e, wrap it 1:1 via the Collateral Onramp (0x9307...B8ee) — the polymarket.com UI does this automatically; API users wrap manually.

"CLOB order failed"

The CLOB sell may fail due to:

  • Insufficient liquidity at the sell price
  • IP blocked by Cloudflare (try proxy)

Your split still succeeded - you have the tokens, just couldn't sell unwanted side.

"Approvals not set"

First trade requires contract approvals. Run:

uv run python scripts/polyclaw.py wallet approve

License

Apache 2.0

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 358
本站分层T2
该仓技能数1
原文件路径SKILL.md