Kalshi Eth Btc Beta Trader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:45 AM UTC
• Version: 1.0.8

Overview

This trading skill is mostly coherent, but it asks for high-value financial credentials and performs some authenticated account changes under a dry-run workflow, so it should receive manual review before installation.

Install only if you are comfortable giving the skill and its Python dependencies access to Simmer trading credentials and a Solana private key. Prefer a dedicated low-balance trading wallet, avoid providing SOLANA_PRIVATE_KEY for dry-run or read-only use, review/pin simmer-sdk before live use, and expect default runs to potentially import markets into your Simmer account even when no trades are placed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: clawhub.json:7

Finding

Unpinned Privileged Trading Dependency Creates a Supply-Chain Risk

Content

View full analysis

SDK tab") sys.exit(1) venue = os.environ.get("TRADING_VENUE", "kalshi") _client = SimmerClient(api_key=api_key, venue=venue, live=live) ``` ### Technical Analysis The project requests `simmer-sdk` without an exact version, artifact hash, or lock-file constraint. Package resolution can therefore select a newer release than the one reviewed when this Skill was published. The package executes in the same Python process as the Skill and is explicitly given `SIMMER_API_KEY`. Like any imported Python module, it can also inspect all environment variables available to the process, including `SOLANA_PRIVATE_KEY` when users follow the manifest requirements. The SDK controls authenticated network requests and trade execution, making it part of the trusted financial execution boundary. The project documentation identifies a package publisher and source repository, but this does not cryptographically bind the package installed from PyPI to a reviewed source ...[truncated 1584 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: clawhub.json:3

Finding

Wallet Private Key Is Required Beyond the Skill's Demonstrated Needs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: trader.py:524

Finding

Dry-Run Mode Performs Authenticated Remote State Changes

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose understates the skill's actual capabilities, including use of an additional private key, position management, market discovery, persistent configuration changes, and optional external logging. This mismatch can cause users or automated policy systems to approve a skill under false assumptions, exposing trading funds, credentials, or data to broader operations than intended.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Requesting SOLANA_PRIVATE_KEY is unjustified by the stated purpose of Kalshi ETH/BTC beta trading, making the secret request suspicious and materially increasing attack surface. In a skill that trades on Kalshi, an unrelated wallet private key could be exfiltrated or misused without user expectation, causing direct loss of on-chain funds.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill requests and uses sensitive environment-backed credentials but does not declare an explicit tool scope or permissions boundary in the manifest. In an agent ecosystem, this weakens operator visibility and policy enforcement, making it easier for the skill to access secrets or capabilities beyond what a reviewer expects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest requests SOLANA_PRIVATE_KEY even though the skill is described as a Kalshi ETH/BTC trading strategy that only claims to need SIMMER_API_KEY and simmer-sdk. Requesting an unrelated blockchain private key creates unnecessary secret exposure and could enable theft or unauthorized signing if later code accesses that variable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest asks for a private key environment variable with no warning, consent language, or explanation to the user. Even if not actively malicious, collecting a raw private key without prominent disclosure is unsafe because users may provide highly privileged credentials they do not realize are unrelated to the advertised strategy.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises a simpler requirement set while also supporting real-money live trading that depends on additional sensitive credentials and operational risk. This can mislead an operator into enabling --live without fully understanding that the skill can place real trades and may require wallet key material, increasing the chance of accidental fund exposure or unintended execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says only SIMMER_API_KEY is required, while setup instructions and later sections additionally require SOLANA_PRIVATE_KEY. Credential inconsistencies create a review and deployment hazard: operators may provide a sensitive private key without having seen it declared up front, or security controls may fail to classify the skill as wallet-accessing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The stated purpose is to trade ETH price markets using BTC as a signal source. While reading BTC market data is expected, this implementation goes further by actively importing BTC markets with import_kalshi_market, which is an additional side effect not conveyed by the manifest description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill's purpose is market analysis and trading based on ETH/BTC beta lag. Adding a CLI path that writes updated configuration via update_config introduces local state mutation unrelated to the core trading capability and not mentioned in the manifest.

Content

No source excerpt is available for this finding.