Kalshi Crypto Cycle Model Trader
v1.0.1Trades Bitcoin year-end price markets on Kalshi using the 4-year halving cycle pattern to compute fair price probabilities. Requires SIMMER_API_KEY and simme...
⭐ 0· 46·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
The skill claims to price and trade Bitcoin year‑end bins via the Simmer SDK/Kalshi and the files (trader.py, SKILL.md, clawhub.json) request SIMMER_API_KEY and a SOLANA_PRIVATE_KEY for live trading. Requiring a Simmer API key and a private key is proportionate for a live trading skill. Minor inconsistency: registry metadata shown at the top of the evaluation listed ‘Required env vars: none’, whereas clawhub.json and SKILL.md both declare SIMMER_API_KEY and SOLANA_PRIVATE_KEY. This appears to be a documentation/registry mismatch rather than malicious behavior.
Instruction Scope
SKILL.md and trader.py focus on market discovery, probability computation, and trading execution. The instructions and code reference only trading-related actions (Simmer client calls, market parsing, optional journal logging). The skill defaults to dry‑run and only executes live trades when explicitly run with --live. No instructions attempt to read unrelated system files.
Install Mechanism
No binary install spec is embedded (instruction-only + included Python code). The declared dependency is the simmer-sdk PyPI package, which is reasonable for this integration but is a third‑party package—review its source (links are provided in SKILL.md) before supplying live credentials.
Credentials
The skill requires two high‑sensitivity items: SIMMER_API_KEY (API authority) and SOLANA_PRIVATE_KEY (base58 private key for signing live trades). These are expected for a live trading agent, but they are high-value credentials. The code also reads optional env vars (TRADING_VENUE, AUTOMATON_MAX_BET) that are not listed in the top-level registry metadata; that mismatch should be clarified. Only provide full private keys to code you trust; consider using an account with limited funds or an ephemeral signing key where possible.
Persistence & Privilege
The skill is not forced-installed (always: false) and autostart is false. The automaton metadata shows an entrypoint (trader.py) and managed:true, meaning the skill can be run/managed by the platform but will not start automatically after install. The agent retains the normal ability to invoke the skill autonomously unless you disable model invocation (default behavior for skills).
Assessment
This skill appears to do what it says (price BTC bins using a halving-cycle model and place trades via Simmer/Kalshi). Before enabling live trading: 1) Verify the simmer-sdk package source and review its code (SKILL.md provides links). 2) Treat SIMMER_API_KEY and especially SOLANA_PRIVATE_KEY as high‑value credentials—use a separate/truncated account or small fund allocation for testing. 3) Run the skill in dry‑run mode and inspect logs/output to confirm behavior. 4) Ask the publisher to fix the registry metadata misreporting required env vars and to document what TRADING_VENUE/AUTOMATON_MAX_BET do. 5) If you are uncomfortable providing a raw private key, request an alternative signing mechanism (hardware or delegated signing) or limit the bot to paper trading only.Like a lobster shell, security has layers — review code before you run it.
latestvk9727spemprs5vrcac8bg6h8c5847ws5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.