polymarket — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited polymarket (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Trade prediction markets on Polymarket through Superior Trade. Discover markets, place single immediate market orders, write NautilusTrader strategies, backtest against historical trade data, and deploy live — all through one API.
Read ../../references/unified-runtime.md before any Superior Trade request. Use only methods, fields, and capabilities published by Unified OpenAPI.
Base URL: https://api.superior.trade. If the environment configures a different base URL, use that instead. Auth: Prefer x-api-key: <api_key> for Superior Trade product API keys. Browser/session callers may use Authorization: Bearer <token>. Docs: GET /openapi.json (Unified OpenAPI contract)
Load these on demand — each is the full detail behind a summary below.
| Read | When |
|---|---|
references/api.md | You need Unified route selection for account, wallet, market discovery, typed execution, backtest, or deployment. |
references/strategy-authoring.md | You are writing NautilusTrader strategy code — structure, order submission, dollars-to-shares conversion, multi-instrument setups, available data. |
references/example-strategies.md | You want a worked starting point: carry/yield harvesting, momentum/news fade, or spread capture. |
references/strategies.md | You are choosing an archetype for the user's thesis and need the fit/anti-fit table. |
references/troubleshooting.md | A strategy source, backtest, or deployment is failing, or a deployment trades zero times. |
Environment-specific facts that defy reasonable assumptions. Read these before acting.
GET /wallet only for the managed wallet data it returns. If a required Polymarket funding action is absent from the Unified contract, report it as unavailable.GET /context/markets; if the user pastes a Polymarket event URL, pass the whole URL as the query so child markets expand.shares = dollars / price (see references/strategy-authoring.md).PUT /runtime/deployments/{id}/credentials; never infer or send undisclosed key material.This skill uses the same Superior Trade API key as every other venue — there is no separate prediction-market key:
x-api-key: $SUPERIOR_TRADE_API_KEYIf SUPERIOR_TRADE_API_KEY is not set, use the registration and verification flow in the superior-trade-auth skill.
The managed wallet is read through /wallet. Polymarket support is discovered through /context/venues; exact capabilities come from /openapi.json.
Before live trading:
GET /wallet.GET /context/venues and GET /runtime/frameworks.GET /openapi.json, stop and report it.PUT /runtime/deployments/{id}/credentials only when the current contract requires it.Use only the credential schema published by Unified API. Never infer a secret or wallet field from an older payload.
Current account/funding endpoints:
GET /accountGET /walletGET /wallet/depositsGET /wallet/withdrawalsPOST /wallet/withdrawGET /context/venuesPOST /runtime/executionsUse POST /runtime/executions when the user asks to place one immediate Polymarket bet/order. This is a fast path for a whitelisted placeMarketOrder action, not a strategy deployment. Do not create a deployment plan or run a backtest for a one-off order unless the user asks for a strategy or bot.
Required sequence:
SUPERIOR_TRADE_API_KEY.GET /wallet.account_address only to an address verified by GET /wallet.GET /context/venues and the wallet balance. If the required capability or collateral is unavailable, stop and report the blocker.POST /runtime/executions and report the real API result. Never fabricate fills, order IDs, balances, or status.Supported action:
{
"venue": "polymarket",
"account_address": "0x1234567890123456789012345678901234567890",
"action": {
"type": "placeMarketOrder",
"tokenID": "1234567890",
"side": "BUY",
"amount": "10",
"price": 0.55,
"orderType": "FOK"
}
}Fast confirmation format:
Order Summary:
• Venue: Polymarket
• Wallet address: [wallet address from GET /wallet] — capability: [Polymarket support from GET /context/venues]
• Token ID: [tokenID]
• Side: [BUY/SELL]
• Amount: [amount] pUSD
• Limit price: [price]
• Order type: [orderType]
This will submit one REAL Polymarket market order immediately. Proceed? (yes/no)Inspect the durable execution with GET /runtime/executions/{id}. If the Unified contract does not expose the current position or open-order read the user needs, say that it is unavailable instead of querying with undisclosed venue credentials.
This skill requires exactly one credential: a Superior Trade API key. The only secret the agent uses is SUPERIOR_TRADE_API_KEY.
Security rules (non-negotiable):
| Can do | Cannot do |
|---|---|
| Read Unified account, wallet, venue, and market context | Access other users' data |
| Run supported filled-data backtests | Export, accept, or view private keys |
| Create and manage Unified deployments | Guess holdings from deployment state |
| Place or cancel a typed Polymarket order after confirmation | Invent balances or trade results |
| Inspect durable execution records | Transfer or bridge arbitrary funds |
volume_24h and liquidity.end_date. Never deploy a strategy on a market that resolves before the strategy has time to work.Before any live deployment start, the agent MUST present this summary and wait for an explicit affirmative response:
Deployment Summary:
• Deployment: [deployment_id]
• Venue: Polymarket
• Market(s): [market question(s)]
• Wallet address: [0x...] — readiness: [ready/blockers from status endpoint]
• Trade size/risk settings: [from deployment.config]
• Backtest reviewed: [backtest_id / result summary]
⚠️ This will trade with REAL funds. Proceed? (yes/no)Do NOT start a live deployment without an explicit affirmative response.
If the same task fails 3+ times (e.g. strategy source/config keeps failing, backtest keeps erroring), stop and:
1. Confirm auth → Use existing `SUPERIOR_TRADE_API_KEY`
2. Managed wallet → GET /wallet
3. Check readiness → GET /context/venues and GET /runtime/frameworks
4. Read live state → Use contract-supported Unified reads; if exposure state is unavailable, report the limitation and block actions whose safety depends on it
5. Funding check → Use the deposit details and balances from GET /wallet
6. Discover markets → GET /context/markets?venue=polymarket
7. Write strategy → Author NautilusTrader Python strategy code from the closest archetype
8. Backtest → POST /runtime/backtests with `strategyId`, `strategySource`, and `strategyConfig`
9. Review results → Poll/read backtest status/result/logs; analyze performance; iterate or proceed
10. Plan deployment → POST /runtime/deployments with top-level framework, venue, mode, name, code, and config
11. Store credentials → PUT /runtime/deployments/{id}/credentials with the contract-defined form
12. Start → Confirm with user → PUT /runtime/deployments/{id}/status `{ "action": "start" }`
13. Monitor/stop → Use status/logs and any contract-supported exposure reads; never claim the wallet is flat when exposure reads are unavailable; stop with PUT `/runtime/deployments/{id}/status` `{ "action": "stop" }`Deployment start requires both credential metadata and explicit user confirmation.
When a user asks for a Polymarket strategy, pick an archetype first and then generate strategy code from it. This keeps backtest assumptions explicit and reduces silent drift.
probability-momentum skill) — momentum, breakout, fast reaction in active marketsprobability-mean-reversion skill) — overreaction fade and range-like behaviordeadline-drift skill) — time-to-resolution behavior, especially before-date marketsrelated-market-spread skill) — relative-value checks across linked marketslarge-fill-pressure skill) — repeated oversized fills with directional follow-throughcatalyst-confirmation skill) — event thesis with market confirmation firstOperational rules:
POST /runtime/backtests via strategySource with matching strategyConfig.TradeTick) in backtests; do not promise queue/maker behavior without matching evidence.Filled-data rule: Polymarket strategy logic should be driven by historical TradeTick replay in backtesting. If logic is quote-only, flag it as likely non-tradable in current backtest mode.
Before PUT /runtime/deployments/{id}/status → {"action":"start"}:
GET /wallet and GET /context/venues show the required support and balance. If not ready, report the returned blocker.PUT /runtime/deployments/{id}/credentials with the Unified contract's form; do not improvise secret fields.GET /context/markets?venue=polymarket → confirm the canonical symbol and framework identifier. If several candidates match, show them and ask the user to choose. Require backtest_ready: true and verify the requested range against GET /context/datasets.instrument_id formatted as <clobTokenId>.POLYMARKET.Do NOT skip any step or assume it passed without the API call.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.