copy-trading
Enables users to automatically copy trades from successful wallets on Polymarket, enhancing trading strategies with configurable settings.
Install this skill
Security score
The copy-trading skill was audited on Feb 19, 2026 and we found 25 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 160 | console.log(`Copied ${event.side} on ${event.market}`); |
Template literal with variable interpolation in command context
| 161 | console.log(`Original: $${event.originalSize}, Copied: $${event.copiedSize}`); |
Template literal with variable interpolation in command context
| 165 | console.log(`Stop-loss hit on ${event.market}`); |
Template literal with variable interpolation in command context
| 166 | console.log(`Loss: $${event.loss}`); |
Template literal with variable interpolation in command context
| 170 | console.log(`Take-profit hit on ${event.market}`); |
Template literal with variable interpolation in command context
| 171 | console.log(`Profit: $${event.profit}`); |
Template literal with variable interpolation in command context
| 175 | console.log(`Limit reached: ${event.type}`); |
Template literal with variable interpolation in command context
| 190 | console.log(`Following: ${status.followedCount} wallets`); |
Template literal with variable interpolation in command context
| 191 | console.log(`Today's P&L: $${status.dailyPnl}`); |
Template literal with variable interpolation in command context
| 192 | console.log(`Active positions: ${status.activePositions}`); |
Template literal with variable interpolation in command context
| 210 | console.log(`${trader.address}`); |
Template literal with variable interpolation in command context
| 211 | console.log(` Win rate: ${(trader.winRate * 100).toFixed(1)}%`); |
Template literal with variable interpolation in command context
| 212 | console.log(` Volume: $${trader.totalVolume.toLocaleString()}`); |
Template literal with variable interpolation in command context
| 213 | console.log(` P&L: $${trader.pnl.toLocaleString()}`); |
Template literal with variable interpolation in command context
| 214 | console.log(` Trades: ${trader.tradeCount}`); |
Template literal with variable interpolation in command context
| 223 | console.log(`Win rate: ${analysis.winRate}%`); |
Template literal with variable interpolation in command context
| 224 | console.log(`Avg trade size: $${analysis.avgTradeSize}`); |
Template literal with variable interpolation in command context
| 225 | console.log(`Best market: ${analysis.bestMarket}`); |
Template literal with variable interpolation in command context
| 226 | console.log(`Worst market: ${analysis.worstMarket}`); |
Template literal with variable interpolation in command context
| 227 | console.log(`Avg hold time: ${analysis.avgHoldTime} hours`); |
Template literal with variable interpolation in command context
| 228 | console.log(`Sharpe ratio: ${analysis.sharpeRatio}`); |
Access to .env file
| 82 | apiKey: process.env.POLY_API_KEY, |
Access to .env file
| 83 | apiSecret: process.env.POLY_API_SECRET, |
Access to .env file
| 84 | passphrase: process.env.POLY_API_PASSPHRASE, |
Access to .env file
| 85 | privateKey: process.env.PRIVATE_KEY, |
Install this skill with one command
/learn @alsk1992/copy-trading