T05 · Unauthorized Access and Privilege Escalation
Error
- Location
trader.py:397- Finding
Live Exit Logic Can Sell ETH Positions Not Owned by This Skill
- Content
View full analysis
- Remediation
View remediation
Security audit
Kalshi Eth Staking Yield Trader
Security checks for vulnerabilities and agentic risk
Overview
This is a real-money trading skill with disclosed dry-run behavior, but it has overbroad live-trading and credential exposure risks that users should review carefully.
Only install this after reviewing the live-trading flow and using narrowly limited credentials. Prefer a dedicated low-balance wallet and restricted trading account, avoid exposing SOLANA_PRIVATE_KEY for dry-run use, and treat --live as capable of buying, selling, and affecting ETH positions beyond newly opened trades.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
trader.py:307- Finding
Risk Safeguards Fail Open When Market Context Retrieval Fails
- Content
View full analysis
dict: """Get market context with safeguards and edge analysis.""" try: if my_probability is not None: return get_client()._request( "GET", f"/api/sdk/context/{market_id}", params={"my_probability": my_probability} ) return get_client().get_market_context(market_id) except Exception: return None def check_safeguards(context: dict) -> tuple: """Check context for safeguards. Returns (should_trade, reasons).""" if not context: return True, [] ``` ### Technical Analysis `get_market_context()` catches every exception and returns `None` without preserving or reporting the failure. `check_safeguards()` then interprets a missing or empty context as approval to trade. This is a fail-open design. The unavailable context may contain the information required to enforce: - Resolved-market detection - Flip-flop or trading-discipline warnings - Minimum time to resolution - Minimum liquidity requirements - Maximum slippage requirements A network outage, API error, malformed response, authentication problem, or SDK failure therefore disables all of these checks while allowing live execution to continue. Safety checks protecting financial transactions should fail closed when their required inputs cannot be verified. ### Attack Path 1. The Skill identifies a market with a trading signal. 2. Context retrieval fails because of an API outage, malformed response, transient network error, rate limit, SDK defect, or deliberately induced connectivity failure. 3. `get_market_context()` catches the exception and returns `None`. 4. `check_safeguards(None)` returns `(True, [])`. 5. The caller treats the market as approved. 6. In li ...[truncated 586 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
clawhub.json:8- Finding
Security-Sensitive Trading Dependency Is Not Version or Integrity Pinned
- Content
View full analysis
- Remediation
View remediation
" ] ``` - Use a lockfile with cryptographic hashes, or install with pip hash verification. - Record the audited package version and artifact digest in the repository. - Review transitive dependencies and pin them through a generated requirements lockfile. - Automate dependency vulnerability and provenance scanning. - Test upgrades in an isolated environment before changing the pinned version. - Run the Skill with a minimally privileged API key and restricted wallet so dependency compromise has limited consequences. ]]>
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
clawhub.json:4- Finding
Wallet Private Key Is Declared Mandatory Without Direct Use by the Skill
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared behavior materially understates the skill's actual trading and credential usage: it says it buys YES using SIMMER_API_KEY, but the documentation also describes BUY NO, selling/exiting positions, market discovery, and use of SOLANA_PRIVATE_KEY for live trading. For a financial automation skill, this mismatch can cause users to grant stronger authority and accept more trading risk than they intended.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Requesting a private blockchain signing key in a context-inappropriate skill is a strong indicator of overprivileged design and can also be consistent with credential-harvesting behavior. In this skill's context, the mismatch is more dangerous because users would reasonably expect only Kalshi or market-data credentials, not authority over a Solana wallet, so they may expose funds without understanding the risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 83% confidence
- Finding
The skill declares access to sensitive environment variables but does not define an explicit tool or permission scope. In a trading skill, undeclared env access is risky because it can expose high-value credentials such as API keys or private keys beyond what users expect from the manifest.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation conflicts on whether only SIMMER_API_KEY is required or whether SOLANA_PRIVATE_KEY is also required. For a skill handling real-money trades, ambiguity around secret requirements is dangerous because users may provide an unnecessary private key or misunderstand when live-signing authority is being used.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The setup text says SOLANA_PRIVATE_KEY is required even though the skill elsewhere claims to default to dry-run mode with no real execution until --live is passed. This contradiction can pressure users into exposing a private key unnecessarily, increasing the chance of credential compromise or accidental live-trading enablement.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest requests a SOLANA_PRIVATE_KEY even though the stated function is trading ETH markets on Kalshi using staking-yield logic, which does not obviously require Solana signing authority. This kind of capability mismatch is dangerous because it grants access to a highly sensitive secret unrelated to the declared behavior, increasing the chance of secret theft, wallet compromise, or unauthorized blockchain transactions if the skill or a dependency is malicious or later compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Requiring a private key without any user-facing warning or disclosure is unsafe because users are not informed that they are handing over a secret capable of authorizing transactions and draining assets. The absence of disclosure materially increases social-engineering risk and makes the unjustified Solana key request in this particular Kalshi ETH trading skill even more suspicious.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description understates the credentials and execution path needed for live trading. Users may enable live mode believing only an API key is involved, when the code is designed to execute real trades through an external wallet-backed flow, increasing the risk of accidental exposure of sensitive signing material or unintended financial activity.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest claims a one-sided strategy that only buys YES when ETH is underpriced, but the code also generates NO trades when the computed edge is negative. This mismatch can cause operators to grant the skill broader trading authority than intended, leading to unexpected positions and losses because actual behavior exceeds the disclosed strategy.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest frames the skill as trading ETH price markets on Kalshi using a staking-yield heuristic. The code additionally searches for importable markets and imports them into Simmer automatically, which is a separate market-ingestion behavior not disclosed in the manifest.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest describes a trading strategy, not a configuration-management tool. This file accepts --set KEY=VALUE and writes updates through update_config, introducing local state modification unrelated to the core market-trading function described to users.
- Content