Security audit

Kalshi F1 Points Model Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed automated trading skill with real-money capabilities, but the sensitive behavior is aligned with its stated purpose and gated by dry-run defaults.

Install only if you intend to run an automated trading tool. Start in dry-run, do not provide a main wallet private key, use a dedicated low-balance Solana wallet and limited trading credentials, keep position limits small, and review simmer-sdk before enabling --live.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill description understates its effective capabilities and credential needs: it markets itself mainly as a modeling/trading template requiring `SIMMER_API_KEY`, while the document later reveals live trade execution, position management, persistent configuration, reporting integrations, and a `SOLANA_PRIVATE_KEY` for live mode. This mismatch can cause operators to grant stronger credentials or trading authority than they intended, increasing the chance of unauthorized financial actions or poor review decisions.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation says both `SIMMER_API_KEY` and `SOLANA_PRIVATE_KEY` are required, but the manifest only declares `SIMMER_API_KEY`. This inconsistency can bypass platform-level credential review, confuse operators about what secrets the skill may use, and lead to undeclared access to a high-value private key in live mode.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The manifest requests access to SOLANA_PRIVATE_KEY even though the skill is described as a Kalshi F1 championship trader driven by standings data and Monte Carlo modeling. Requesting an unrelated blockchain private key materially expands the trust boundary and could enable unauthorized wallet access or fund transfers if the runtime or downstream code uses that secret.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill's stated purpose does not justify requesting a blockchain private key, making the secret request suspicious and unsafe by default. A private key is a highly sensitive credential that could be used to sign transactions, exfiltrate assets, or impersonate the user on-chain, so unjustified collection represents a serious security risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The manifest declares a highly sensitive private key without any user-facing disclosure explaining what it will be used for or why it is necessary. This undermines informed consent and increases the chance that users will provide a credential that can later be abused for unrelated blockchain actions.

Static analysis

No suspicious patterns detected.