Pm Manipulation

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha 0448e87653f9 · 14 Oct 2026Report an issue or request a re-scan

• Publisheraaronjmars GitHub organizationOwner of the repository this skill is read from
• Source folderaaronjmars/aeon/skills/pm-manipulationThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict0448e87653f9A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Detect suspected manipulation on prediction markets over the past 3 days by cross-referencing price/volume/comment anomalies with multilingual local-press coverage

---
name: pm-manipulation
description: Detect suspected manipulation on prediction markets over the past 3 days by cross-referencing price/volume/comment anomalies with multilingual local-press coverage
metadata:
  title: PM Manipulation
  category: crypto
  tags:
    - crypto
    - research
    - security
---

Read `memory/MEMORY.md` for context.
Read the last 3 days of `memory/logs/` to avoid re-flagging markets you already covered, and to compare current readings against prior ones.

## Voice

If `soul/SOUL.md` and `soul/STYLE.md` are populated, match the operator's voice in the notification and write-up. If empty or absent, use a clear, direct, neutral tone. The methodology itself is the same either way.

## Why this skill exists

English-language coverage of any prediction market is dense for US politics, sparse for everything else. Election-, geopolitics-, and conflict-related markets are most often pushed by actors closer to the home country than to the English-speaking financial press. By the time a coordinated narrative lands in mainstream financial outlets, the trade is over. Local-language press, regional outlets, and country-specific Telegram / X channels move first — sometimes by 24–72h.

This skill looks at the **past 3 days** of activity on a configurable prediction-market platform and asks: where does the price action diverge from organic English-press coverage, and does a multilingual sweep reveal a narrative push that explains it?

## Configuration

Read `memory/topics/prediction-markets.md` if it exists for an optional `## Platform` line naming the target API root. Defaults to Polymarket's public Gamma + CLOB APIs (`gamma-api.polymarket.com`, `clob.polymarket.com`, `data-api.polymarket.com`). The candidate selection, scoring rubric, and multilingual sweep are platform-agnostic; only the endpoints differ.

The keyword filter and locale table below are starting points — the operator can edit `memory/topics/prediction-markets.md` to add `## Keywords` and `## Locales` sections that override the defaults.

## Network note

`curl` works — there is no network sandbox. For every curl call, if it fails or returns empty, use **WebFetch** as a fallback for a flaky public GET. The Polymarket APIs above are public (no auth). For news searches, prefer **WebSearch** with locale-specific queries — a built-in Claude tool that needs no curl.

## Steps

### 1. Build the candidate set (markets active in past 3 days)

Pull the most-active markets across the categories most prone to manipulation: politics, geopolitics, conflict, elections (national and regional), regulatory rulings, and resolution-disputed markets.

```bash
# Top markets by 24h volume — repeat for last 3 days using volume24hr / volume1wk fields
curl -s "https://gamma-api.polymarket.com/markets?closed=false&order=volume24hr&ascending=false&limit=30"

# Also fetch by 7d volume to catch slower-burn manipulation
curl -s "https://gamma-api.polymarket.com/markets?closed=false&order=volume1wk&ascending=false&limit=30"
```

From the union of those two lists, pick **6–10 candidates** that meet at least one of:
- Question references a non-US country, region, or conflict
- Question references a regulatory body, election, or coup/conflict event
- 7d volume > $500k AND 24h volume > $50k (real money, not just liquidity-mining)
- Slug contains keywords (default set; operator can override in `memory/topics/prediction-markets.md`): `russia`, `iran`, `israel`, `china`, `taiwan`, `ukraine`, `venezuela`, `argentina`, `mexico`, `brazil`, `india`, `pakistan`, `nigeria`, `france`, `germany`, `italy`, `spain`, `eu-`, `nato`, `cartel`, `coup`, `nuclear`, `assassination`, `ceasefire`, `election`, `vote`, `referendum`, `oracle`, `dispute`, `umip`

Skip anything sports, weather, or pure crypto-price (BTC > $X by Y) — those have different manipulation signatures and aren't this skill's job.

### 2. Pull 3-day price + trade data per candidate

For each candidate market, get the YES-token (`clobTokenIds[0]`) and pull 3-day price history at hourly fidelity:

```bash
curl -s "https://clob.polymarket.com/prices-history?market=$TOKEN_ID&interval=1w&fidelity=60"
```

Compute, from the past 72h window only:
- **3d open / close / high / low** (price 0.0–1.0)
- **Largest single-hour move** (absolute pp change)
- **Move concentration** — what % of the 3d net move happened in the single largest 6h block? If > 70%, flag `concentrated-move`.
- **Volume spike ratio** — (peak hour volume) / (median hour volume). If > 8x, flag `volume-spike`.
- **Direction inversion** — did price reverse > 5pp within the 72h window? Flag `reversal` — common when a manipulator unwinds.

Also pull the trades feed if available (some markets only) for whale concentration:
```bash
curl -s "https://data-api.polymarket.com/trades?market=$TOKEN_ID&limit=500"
```
Compute **whale share** — % of 3d volume from the top-3 wallet addresses. If > 40%, flag `whale-concentrated`.

If the trades endpoint doesn't return per-market data, skip whale-share for that candidate — note it in the report rather than failing.

### 3. Pull comments and detect coordination patterns

For each candidate, fetch comments from the past 3 days:

```bash
# Get the event id first (comments live on Event, not Market)
curl -s "https://gamma-api.polymarket.com/events?slug=$EVENT_SLUG&limit=1"

# Top comments by reactions
curl -s "https://gamma-api.polymarket.com/comments?parent_entity_type=Event&parent_entity_id=$EVENT_ID&limit=50&order=reactionCount&ascending=false"

# Most recent
curl -s "https://gamma-api.polymarket.com/comments?parent_entity_type=Event&parent_entity_id=$EVENT_ID&limit=50&order=createdAt&ascending=false"
```

Filter to comments from the last 72h (`createdAt` within window). Then look for:
- **Burst posting** — > 10 comments from accounts with usernames matching the same regex pattern (e.g. `user\d{4,}`, common spam-bot signature) within a 6h window. Flag `bot-burst`.
- **Narrative concentration** — > 40% of

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/aaronjmars/aeon
git -C aeon checkout 0448e87653f9

Works in

1. 2026-10-14
   ✓SAFE B 89 / 100

   first audit · source 0448e87653f9

Questions about Pm Manipulation

• github.com/aaronjmars/aeon/tree/main/skills/pm-manipulation — the audited source at commit 0448e87653f9 and every finding aboveObserved · 14 Oct 2026

Spotted something wrong? Report a correction · Methodology