kalshi api

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:09 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed read-only Kalshi market-data helper with a small configuration risk around its optional API base URL override.

Install this only if you want an agent to query Kalshi market data. Avoid setting KALSHI_BASE_URL unless you trust the destination, and prefer a future version that validates the hostname or restricts it to Kalshi API domains.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kalshi-api.mjs:7

Finding

Unrestricted API Base URL Permits Arbitrary-Host GET Requests

Content

View full analysis

Vulnerability Details

File Location: scripts/kalshi-api.mjs, lines 7 and 43-51
Vulnerability Type: Unvalidated destination URL / limited server-side request forgery (SSRF)
Risk Level: Medium

Vulnerable Code

js

const BASE_URL = process.env.KALSHI_BASE_URL || "https://api.elections.kalshi.com/trade-api/v2";

js

async function request(path, query = {}) {
  const url = `${BASE_URL}${path}${buildQuery(query)}`;
  const res = await fetch(url, {
    method: "GET",
    headers: {
      accept: "application/json",
      "user-agent": "openclaw-skills-kalshi-openapi-reader/1.0",
    },
  });

Technical Analysis

The KALSHI_BASE_URL environment variable is used directly when constructing request URLs. The implementation does not parse or validate the configured URL's protocol, hostname, port, credentials, or resolved IP address.

An attacker who can influence the environment of the CLI process can therefore redirect nominally Kalshi-related requests to an attacker-controlled host or a service reachable only from the execution environment. The request suffix is selected from hard-coded read-only endpoint paths such as /exchange/status, /markets, and /events, which limits control over the complete path but does not prevent arbitrary-origin network access.

The issue is a constrained SSRF-style condition rather than unrestricted request construction: only GET requests are sent, no authentication headers are attached, and endpoint suffixes remain controlled by the application. Nevertheless, the process may have network access unavailable to the attacker, allowing internal service discovery or retrieval of responses from predictable internal paths.

Attack Path

1. The attacker obtains the ability to set or influence KALSHI_BASE_URL in the environment used to launch the Skill.
2. The attacker sets the variable to an internal or attacker-controlled origin, for example `http:/ ...[truncated 1392 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse the configured value with new URL() and reject malformed URLs.
2. Require the https: protocol in production.
3. Allowlist the exact approved Kalshi API hostname and, if appropriate, the expected base path:

   js

   const DEFAULT_BASE_URL =
     "https://api.elections.kalshi.com/trade-api/v2";
   const configured = new URL(
     process.env.KALSHI_BASE_URL || DEFAULT_BASE_URL,
   );
   
   const allowedHosts = new Set([
     "api.elections.kalshi.com",
   ]);
   
   if (configured.protocol !== "https:" ||
       !allowedHosts.has(configured.hostname) ||
       configured.username ||
       configured.password) {
     throw new Error("Invalid KALSHI_BASE_URL");
   }
   
   const BASE_URL = configured.href.replace(/\/$/, "");
   

4. If custom endpoints are required for local development, gate them behind an explicit development-only option rather than accepting arbitrary production environment values.
5. For custom destinations, resolve the hostname and reject loopback, link-local, multicast, unspecified, and private IP ranges. Revalidate redirect targets or disable automatic redirects so an allowlisted host cannot redirect requests to a prohibited destination.
6. Add tests confirming rejection of HTTP URLs, credential-bearing URLs, loopback addresses, private-network addresses, unapproved hostnames, and redirects to prohibited origins.
7. Avoid returning complete destination URLs or raw response bodies to callers when they could contain sensitive internal information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes executable commands that require network access and may read environment configuration, but it declares no explicit tool scope such as allowed-tools or permissions. This creates a policy gap where an agent or runtime may grant broader capabilities than intended, increasing the chance of unintended network access or misuse of environment-derived settings.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

* Read-only endpoints only.
 */

const BASE_URL = process.env.KALSHI_BASE_URL || "https://api.elections.kalshi.com/trade-api/v2";

function parseArgs(argv) {
  const out = { _: [] };

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/kalshi-api.mjs (reported line 8)May include surrounding context.

js

* Read-only endpoints only.
 */

const BASE_URL = process.env.KALSHI_BASE_URL || "https://api.elections.kalshi.com/trade-api/v2";

function parseArgs(argv) {
  const out = { _: [] };

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: tests/kalshi-api.test.mjs:11

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/kalshi-api.mjs:8