Kalshi Eth Merge Momentum Trader

WarnAudited by ClawScan on May 10, 2026.

Overview

This appears to be a real-money trading skill, but it under-declares its need for a trading API key and Solana private key in the registry metadata.

Only use this skill if you intend to run a financial trading bot. Keep it in dry-run mode first, use a dedicated low-balance Solana wallet and scoped API key if possible, verify the external simmer-sdk dependency, and do not enable --live or scheduling unless you accept the real-money risk.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

High

#ASI03: Identity and Privilege Abuse

What this means

A user may not realize from the registry metadata that installing or running this skill can require a high-value API key and a raw Solana private key for live trading.

Why it was flagged

The public requirement contract under-declares credentials that can authorize trading and expose a wallet private key.

Skill content

metadata: "Required env vars: none" / "Primary credential: none"; SKILL.md: "Requires: `SIMMER_API_KEY` and `SOLANA_PRIVATE_KEY`"; clawhub.json: "env": ["SIMMER_API_KEY", "SOLANA_PRIVATE_KEY"]

Recommendation

Treat this as a Review item: use a dedicated low-balance wallet/API key, verify the requirement metadata before installing, and only provide live credentials after reviewing the code and dependency.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If live mode is enabled, the agent can spend real USDC and take positions that may lose money.

Why it was flagged

The skill can place real-money trades when run in live mode, which is expected for a trading skill but financially high-impact.

Skill content

`python trader.py --live` | Live (Kalshi via DFlow) | Real USDC

Recommendation

Start in dry-run mode, keep the default small limits or lower them, and require explicit user approval before any live invocation.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

An unpinned dependency that handles trading credentials can change over time, affecting what code receives API keys or wallet access.

Why it was flagged

The skill relies on an external SDK for trading, but the provided artifacts do not pin a specific package version.

Skill content

`simmer-sdk` is published on PyPI by Simmer Markets. ... Review the source before providing live credentials if you require full auditability.

Recommendation

Review the simmer-sdk source, install a known version, and avoid using live wallet credentials until dependency provenance is acceptable.