Kalshi Fed Temporal Mono Trader

• Analyzed: Apr 7, 2026, 4:26 AM
• Findings: 1
• Version: 1.0.2
• Hash: 315c04a9550a21d96363a64924b7ba9eb34658c237a78984cc2cc0771c2bca2e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a legitimate-looking arbitrage strategy for Kalshi Fed rate markets but is classified as suspicious due to its requirement for a high-value credential (SOLANA_PRIVATE_KEY) and its dependency on an external package (simmer-sdk). While trader.py does not explicitly exfiltrate the key, the script's logic delegates trade execution to the third-party SDK, which creates a significant supply-chain risk for credential theft. The SKILL.md and clawhub.json files explicitly prompt the user to provide this private key, which is a high-risk behavior in the context of unvetted agent skills.