Kalshi Econ Seasonal Trader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 1.0.1

Overview

The skill is a disclosed dry-run-by-default trading bot, but it needs Review because it exposes high-value trading and wallet credentials to an unpinned SDK without tight mode scoping.

Install only if you are comfortable giving this skill and its Simmer SDK dependency access to real trading credentials. Use paper mode first, provide a restricted API key and low-balance wallet, pin or verify the SDK version if possible, and avoid supplying SOLANA_PRIVATE_KEY except in an isolated environment used only for explicit --live runs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:3

Finding

Unpinned Third-Party SDK Executes with Access to High-Value Trading Credentials

Content

View full analysis

Vulnerability Details

File Location: clawhub.json:3-11; related runtime usage in trader.py:45 and trader.py:220-231
Vulnerability Type: Unpinned privileged dependency / software supply-chain risk
Risk Level: Medium

Complete Code Snippet:

json

"requires": {
  "env": [
    "SIMMER_API_KEY",
    "SOLANA_PRIVATE_KEY"
  ],
  "pip": [
    "simmer-sdk"
  ]
},

Related runtime initialization:

python

from simmer_sdk.skill import load_config, update_config, get_config_path

python

def get_client(live=True):
    """Lazy-init SimmerClient singleton."""
    global _client
    if _client is None:
        try:
            from simmer_sdk import SimmerClient
        except ImportError:
            print("Error: simmer-sdk not installed. Run: pip install simmer-sdk")
            sys.exit(1)
        api_key = os.environ.get("SIMMER_API_KEY")
        if not api_key:
            print("Error: SIMMER_API_KEY environment variable not set")
            print("Get your API key from: simmer.markets/dashboard -> SDK tab")
            sys.exit(1)
        venue = os.environ.get("TRADING_VENUE", "kalshi")
        _client = SimmerClient(api_key=api_key, venue=venue, live=live)
    return _client

Technical Analysis

The Skill declares simmer-sdk without an exact version, lock file, or integrity hash. Package installation can therefore resolve to a later release whose code differs from the version originally reviewed. The dependency is imported and executed in the same Python process as the Skill.

That process is configured to receive SIMMER_API_KEY and SOLANA_PRIVATE_KEY. The code explicitly reads the API key and passes it to SimmerClient, which is necessary for authenticated market operations. The project code does not directly read or transmit SOLANA_PRIVATE_KEY; however, the key remains available in the process environment and can be read by imp ...[truncated 1809 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin simmer-sdk to a specifically audited version rather than accepting arbitrary future releases.
2. Install dependencies from a lock file containing cryptographic hashes, such as a hash-locked requirements file generated through a controlled build process.
3. Verify the package publisher, source repository, release signatures, and artifact hashes before upgrades.
4. Run dependency vulnerability and provenance checks in CI, and require review whenever the pinned version or hash changes.
5. Remove SOLANA_PRIVATE_KEY from the Skill's unconditional environment requirements unless the selected execution path demonstrably requires it.
6. Provision wallet credentials only for explicit --live execution. Dry-run, configuration, discovery, and position-display modes should run without access to the private key.
7. Use a restricted trading wallet with minimal funds and narrowly scoped API credentials. Apply server-side spending, venue, and withdrawal restrictions where supported.
8. Isolate the trading process using a dedicated environment or container with a minimal filesystem, restricted outbound network access, and no unrelated credentials.
9. Rotate and revoke credentials immediately if an untrusted dependency version has already executed in the credential-bearing environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description understates its actual capabilities: beyond seasonal signal generation, it can execute live trades, use an additional high-value secret (SOLANA_PRIVATE_KEY), inspect/manage positions, import markets, and modify persistent configuration. This mismatch is dangerous because users, reviewers, or policy systems may approve the skill based on an incomplete understanding, leading to unintended financial actions or exposure of sensitive credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Declaring access to a Solana private key for a seasonal Kalshi trading skill is an unjustified sensitive capability mismatch. Because private keys directly control assets and authorize irreversible transactions, unnecessary exposure of that secret materially increases the risk of wallet compromise or covert exfiltration, especially when the stated skill purpose does not justify it.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares access to sensitive environment variables (SIMMER_API_KEY, and later SOLANA_PRIVATE_KEY) but does not define any explicit tool scope or permission boundaries. In an agent ecosystem, missing scope declarations weaken reviewability and least-privilege controls, making it easier for a trading skill to access credentials without clear user consent or policy enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest declares sensitive credentials but provides no trigger scope, invocation constraints, or other limiting context around when the skill can access them. Even with autostart disabled, broad credential availability without documented boundaries increases the blast radius of any malicious logic, future code change, or accidental misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest requests a SOLANA_PRIVATE_KEY even though the skill is described only as a Kalshi CPI/inflation trader using Simmer. Requiring an unrelated blockchain private key expands access to highly sensitive credentials and creates a credible path for secret misuse, fund theft, or unauthorized signing if the runtime or skill code accesses that key.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The top-level documentation advertises live execution 'via DFlow/Solana' and requires a SOLANA_PRIVATE_KEY for live trading, while the manifest description mentions only SIMMER_API_KEY and simmer-sdk. That creates a semantic mismatch between the declared skill requirements/scope and the actual documented operational model, which includes blockchain-linked live trading credentials beyond what the manifest states.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a strategy focused on trading CPI/inflation markets using seasonal CPI patterns to identify edge. However, this code also scans current positions and automatically sells them when a price threshold is reached, which is broader portfolio/position management behavior not described in the manifest. This is not just a low-level implementation detail because it introduces an additional autonomous trading action with its own logic independent of the seasonal entry model.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The configuration hard-codes a trading setup requiring a private key without any documented user choice or justification tied to the described Kalshi strategy. In a financial skill, hidden or unexplained signing capability is more dangerous because users may supply high-value credentials under the assumption they are necessary, enabling avoidable exposure of account-controlling secrets.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring explicitly states that SOLANA_PRIVATE_KEY is required for live trading, but the code only checks for SIMMER_API_KEY when initializing the client and never accesses SOLANA_PRIVATE_KEY anywhere else. This is an active contradiction between the documentation and the implemented behavior, not merely an omitted detail.

Content

No source excerpt is available for this finding.