kalshi trades

PassAudited by ClawScan on May 10, 2026.

Overview

The skill’s code matches its read-only Kalshi market-data purpose and does not show trading actions, credential use, file writes, or persistence.

This appears appropriate for read-only Kalshi market scouting. Before using it, keep the API base URL at the default or another trusted endpoint, remember that it does not place trades, and independently verify market data before making financial decisions.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If KALSHI_BASE_URL is changed, the skill may read market data from an unintended endpoint, which could mislead scouting results. The artifacts do not show credentials, trades, or local files being sent.

Why it was flagged

All CLI requests are sent to the configured base URL. This is disclosed and purpose-aligned, but an unexpected environment override could redirect market queries to another host.

Skill content
const BASE_URL = process.env.KALSHI_BASE_URL || "https://api.elections.kalshi.com/trade-api/v2"; ... const res = await fetch(url, { method: "GET",
Recommendation

Use the default Kalshi endpoint or only set KALSHI_BASE_URL to a trusted Kalshi-compatible API, and verify results before acting on them.