Polymarket InternationalHyperliquid Read-only
PASS WITH FIXES Tested on Composer 2.5, , result: PASS WITH FIXES. We built these four tools from the prompt and ran the tests offline (12/12 passing), with throwaway keys and mnemonics only. The wallet audit ran read-only against live Polygon and Hyperliquid data for a fresh throwaway address. No real keys, transactions or money. The prompt below includes the fixes from that run (download the real BIP39 wordlist; audit every spender and operator the SDK lists).
Short answer: Give a trading bot its own dedicated hot wallet holding only what it can lose. Keep the key in an env file outside the repo with chmod 600, and never paste a seed phrase into an AI chat. Revoke unlimited token approvals when the bot retires, and keep a kill switch. This recipe has your AI tool build four tested tools that enforce those rules: a secret scanner, an env guard, a kill switch and a read-only wallet audit.
~/.config/<bot>/.env with chmod 600, outside the git repo, loaded by code that refuses anything else.Four small, tested Python tools you drop into any bot project: a pre-commit secret scanner that catches private keys and seed phrases, an env loader that refuses unsafe key files, a one-file kill switch, and a read-only audit that checks a bot wallet's balance cap, approvals and API wallets from its public address.
Anyone about to give an AI-built bot a crypto wallet: Polymarket international, Hyperliquid or any EVM chain.
Not for: Moving funds or sending revoke transactions for you. The audit prints what to revoke; you do that yourself in your own wallet.
Most bot losses that aren't strategy losses are key losses: a private key committed to GitHub, a seed phrase pasted into a chat to "help debug", a forgotten unlimited approval on a wallet that also holds savings. This pack is the boring layer that stops those. It works alongside the site-wide Safety Pack (rules file, .gitignore, pre-commit config) and the kill switch and position limits recipe.
Works in Claude Code, Cursor, Codex/ChatGPT, Grok or any agent that can write files. Paste it into an empty folder. Read what it builds before you run anything.
You are building a small wallet-safety toolkit in Python for crypto trading
bots. It must NEVER need, read or print a real private key or seed phrase,
and it must NEVER send a transaction. If a step seems to need a key, stop
and tell me.
Project: wallet-guard/
- Python 3.10+, `requests`, `pytest`; `eth_account` ONLY in tests, to
generate throwaway keys and mnemonics.
- secret_scan.py
- Scans staged git files (git diff --cached --name-only
--diff-filter=ACM) or given paths, or stdin with --stdin.
- Flags: 64-hex strings with or without 0x (private-key shaped); runs of
12+ consecutive lowercase BIP39 English words. Download the official
wordlist file (don't type it from memory or embed a partial list):
curl -o bip39_english.txt https://raw.githubusercontent.com/bitcoin/bips/master/bip-0039/english.txt
Load it at runtime and assert it has exactly 2048 words; fail loudly
if the file is missing; assignments like
private_key= / secret= / mnemonic= / seed= / passphrase= with a
literal value; and file names .env, .env.*, keystore.json, id_rsa.
- Do NOT flag values starting with $, {, os.environ, getenv, <, your_
(env references and f-string templates), 40-hex addresses, or any line
containing the marker "secret-scan: allow".
- Print file:line and the REASON, never the matched value. Exit 1 on any
hit.
- Install it as .git/hooks/pre-commit (and show the pre-commit
framework equivalent).
- env_guard.py: load_secrets(path, required=[...]) refuses (raises) if the
file is inside a git working tree (walk up looking for .git), has any
group/other permission bits (require chmod 600), is owned by another
user, or is missing a required key. redact(value) returns
"<redacted N chars>".
- kill_switch.py: KILL file path from BOT_KILL_FILE (default
~/.config/bots/KILL). check() raises Killed if it exists. CLI:
`on "reason"`, `off`, `status`.
- wallet_audit.py (READ-ONLY, public address only):
- Refuse any argument that isn't a 42-char 0x address (exit 2).
- polygon mode via public RPC https://polygon.drpc.org (eth_call,
eth_getBalance): POL balance, pUSD balance (token
0xC011a7E12a19f7B1f670d46F03B03f3342E82DFB, read decimals()),
allowance(owner, spender) for each Polymarket spender, and
isApprovedForAll(owner, operator) on the Conditional Tokens and
PositionManager contracts. Take the spender/operator list from the
official `polymarket-client` SDK (PublicClient().
get_trading_approvals_state(wallet=...)) and check EVERY spender and
operator it returns (the current SDK lists 7 pUSD spenders and 10
operator approvals, more than older guides mention). Never hardcode a
short list or stop at the first few. Cross-check each address against
https://docs.polymarket.com/resources/contracts and label any that
aren't on that page as "not on docs page" rather than skipping them.
Flag any allowance >= 2**255 as UNLIMITED. A test must assert the audit
covers every spender/operator the (mocked) SDK returns.
- hyperliquid mode: POST /info clearinghouseState for account value and
{"type":"extraAgents","user":...} to list approved API wallets
(name, address, validUntil).
- --cap USD: flag balances above the cap ("move the excess out").
- For each approval, print revoke calldata for the user to review in
their own wallet: approve(spender, 0) = 0x095ea7b3...,
setApprovalForAll(operator, false) = 0xa22cb465... Never sign or send.
- Tests (offline): detects a generated key and a generated 12-word
mnemonic; no false positive on an address, an env reference, or an
allow-marked line; scan output never contains the secret; env_guard
rejects 0644, an in-repo file and missing keys; kill switch on/off;
revoke calldata shape; audit refuses key-shaped input; grep that
wallet_audit.py contains no eth_sendRawTransaction, sign_transaction or
private_key.
- README: the 6 rules (dedicated wallet, minimal balance, no seed phrase
in any AI chat, env file outside the repo, revoke approvals on
retirement, kill switch) and how to run each tool.
Show me the file plan first. After writing, tell me exactly what to run.wallet-guard), add the Safety Pack files, and paste the prompt.bip39_english.txt was downloaded (2048 lines), then pip install requests pytest eth-account && pytest. All of them should pass offline.printf '#!/bin/sh\nexec python3 /path/to/wallet-guard/secret_scan.py\n' > .git/hooks/pre-commit
chmod +x .git/hooks/pre-commit
git add it, and watch the commit get blocked.pbpaste | python3 secret_scan.py --stdin (or xclip -o on Linux).mkdir -p ~/.config/mybot && mv .env ~/.config/mybot/.env && chmod 600 ~/.config/mybot/.env, and load it with env_guard.load_secrets(...).from kill_switch import check; check(). Then try python3 kill_switch.py on "testing".python3 wallet_audit.py polygon 0xYourBotWallet --cap 50
python3 wallet_audit.py hyperliquid 0xYourMainAddress --cap 50
Nothing here trades, so it's safe to run on day one, before you build any bot. Practise the full drill on a fresh throwaway address with no funds:
Then use the same tools with the Polymarket CLOB API Starter and the Hyperliquid API Starter.
Tick every box before the bot touches real money. The full rules file, .gitignore and pre-commit hook are in the Safety Pack.
.env and *.pem are in .gitignore, and your AI tool is blocked from reading them (see the Safety Pack).touch KILL) stops new orders immediately, and a second command cancels every resting order through the venue's cancel-all endpoint.--live flag and a typed confirmation, and you only flip it after days of clean paper logs.Endpoints and rules were checked against these pages on Oct 22, 2026. APIs change, so if something here disagrees with the official docs, trust the docs and tell us.
It's a wallet whose key sits on the machine running the bot, so the bot can sign without you. That convenience is the risk. Give each bot its own hot wallet holding only what the bot can afford to lose, and keep everything else in a wallet the bot never touches.
Close. A burner wallet is a throwaway address you use for one purpose and abandon. For bots, use a fresh burner per bot or per experiment, never reuse your main wallet, and abandon it (after revoking approvals and moving funds) when the bot retires.
No. Never paste a seed phrase or private key into any AI tool, chat, issue or screenshot. Your AI coding tool never needs the key itself, only the name of the environment variable your code reads. The scanner's --stdin mode checks text before you paste it.
Run the audit to list approvals. Then, from your own wallet, call approve(spender, 0) for ERC-20 allowances and setApprovalForAll(operator, false) for ERC-1155 approvals, or use a tool like Revoke.cash. Our audit prints the exact calldata but never sends it.
In an env file outside the repository (for example ~/.config/mybot/.env) with chmod 600, loaded by code that checks those rules. Add .env to .gitignore anyway, and run the secret scanner as a pre-commit hook.
Stop new orders immediately, without a code change or redeploy. A file the bot checks before every order is the simplest version that works. Pair it with exchange-side protection, such as Hyperliquid's scheduled cancel-all.
One new build recipe, one safety tip, and API changes worth knowing about. Free. No picks, ever.
A tested AI prompt that builds a Python starter for the international Polymarket CLOB API: Gamma market data, correct order books, per-market fees, L1/L2 auth explained, and a paper broker. No orders, no keys.
A tested AI prompt that builds a Hyperliquid API starter in Python: public info reads on mainnet and testnet, then testnet-only orders signed by an API (agent) wallet, with tick rounding, a $10 minimum and a dead-man switch.
Add a three-layer kill switch and hard position limits to any AI-built prediction-market bot: a local KILL file, venue cancel-all endpoints, and Kalshi order groups. Copy-paste prompt included.
A tested AI prompt that builds a read-only Hyperliquid funding-rate monitor in Python: current and predicted funding per perp, annualized, with threshold alerts to the console or a webhook, on mainnet or testnet. No keys, no orders.
More from the kitchen: Recipes by platform · Kalshi & Polymarket fee calculator · AI model test results · Safety Pack