kalshi-trade

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to be a read-only Kalshi market-data reader; the static alerts are explained by a test runner and a non-secret API base URL override.

Before installing, confirm you only need read-only Kalshi market data and leave KALSHI_BASE_URL unset unless you trust the alternate endpoint. This skill does not appear to trade or manage funds.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If the base URL is changed, selected market tickers and query parameters could be sent to that alternate endpoint.

Why it was flagged

The API destination can be overridden through an environment variable, so market queries would be sent to the configured endpoint. The behavior is disclosed in SKILL.md and the script uses read-only GET requests without credentials.

Skill content

const BASE_URL = process.env.KALSHI_BASE_URL || "https://api.elections.kalshi.com/trade-api/v2";

Recommendation

Use the default Kalshi API URL unless you intentionally trust the replacement endpoint.