ClawHub
Back to skill

Security audit

Kalshi F1 Teammate Anti Trader

Security checks for vulnerabilities and agentic risk

Overview

This is a real-money trading skill that is mostly coherent, but it asks for a raw Solana wallet key more broadly than its workflows justify.

Install only if you are comfortable with a skill that can place real trades when run with --live and that currently asks for a raw Solana private key. Use a dedicated low-value wallet and narrowly scoped/revocable trading credentials, keep dry-run workflows separate from wallet-key provisioning, and pin/review simmer-sdk before live use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
clawhub.json:8
Finding

Unpinned Third-Party SDK Executes with Access to Trading Credentials

Content
View full analysis

Vulnerability Details

File Location: clawhub.json:8-10, SKILL.md:11-12, trader.py:47-48, trader.py:253-263
Vulnerability Type: Unpinned privileged dependency
Risk Level: Medium

Vulnerable Code

clawhub.json:8-10:

json
"pip": [
  "simmer-sdk"
]

trader.py:47-48:

python
from simmer_sdk.skill import load_config, update_config, get_config_path

trader.py:253-263:

python
def get_client(live=True):
    """Lazy-init SimmerClient singleton."""
    global _client
    if _client is None:
        try:
            from simmer_sdk import SimmerClient
        except ImportError:
            print("Error: simmer-sdk not installed. Run: pip install simmer-sdk")
            sys.exit(1)
        api_key = os.environ.get("SIMMER_API_KEY")
        if not api_key:
            print("Error: SIMMER_API_KEY environment variable not set")
            print("Get your API key from: simmer.markets/dashboard -> SDK tab")
            sys.exit(1)
        venue = os.environ.get("TRADING_VENUE", "kalshi")
        _client = SimmerClient(api_key=api_key, venue=venue, live=live)
    return _client

Technical Analysis

The project declares simmer-sdk without an exact version, package hash, or lockfile. Python executes dependency initialization code as soon as the module is imported. This dependency is imported both during global configuration initialization and when creating the trading client.

The SDK operates in a process that can contain SIMMER_API_KEY and SOLANA_PRIVATE_KEY. It also receives the Simmer API key directly and controls market queries and trade submission. Consequently, an unexpectedly changed or compromised future package release would execute with the same process privileges and could inspect environment variables, modify trade requests, or communicate with unauthorized endpoints.

The reviewed project does not itself demonstrate that the ...[truncated 1561 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin simmer-sdk to an audited exact version rather than allowing unconstrained resolution.
  2. Use a requirements or lock file containing cryptographic package hashes, and install with hash verification enabled.
  3. Review and approve dependency updates before deployment instead of automatically accepting the newest release.
  4. Verify package publisher provenance and monitor the package for ownership or release-signing changes.
  5. Run network-facing trading code in a restricted environment with an explicit destination allowlist.
  6. Separate wallet signing from the SDK process so the dependency cannot directly retrieve private key material.
  7. Use narrowly scoped, revocable trading credentials with server-side limits on venues, order sizes, and aggregate exposure.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
clawhub.json:2
Finding

Solana Private Key Is Provisioned Beyond the Workflows That Require It

Content
View full analysis

Vulnerability Details

File Location: clawhub.json:2-10, SKILL.md:72-74, SKILL.md:86-91; contrasted with trader.py:253-263
Vulnerability Type: Excessive credential provisioning and failure to enforce least privilege
Risk Level: Medium

Vulnerable Configuration

clawhub.json:2-10:

json
"emoji": "🏎️",
"requires": {
  "env": [
    "SIMMER_API_KEY",
    "SOLANA_PRIVATE_KEY"
  ],
  "pip": [
    "simmer-sdk"
  ]
},

SKILL.md:72-74:

markdown
Requires: `SIMMER_API_KEY` and `SOLANA_PRIVATE_KEY` environment variables.

SKILL.md:86-91:

markdown
## Required Credentials

| Variable | Required | Notes |
|----------|----------|-------|
| `SIMMER_API_KEY` | Yes | Trading authority. Treat as a high-value credential. |
| `SOLANA_PRIVATE_KEY` | Yes | Base58-encoded Solana private key for live trading. |

The client initialization in trader.py:253-263 explicitly retrieves only the API key:

python
def get_client(live=True):
    """Lazy-init SimmerClient singleton."""
    global _client
    if _client is None:
        try:
            from simmer_sdk import SimmerClient
        except ImportError:
            print("Error: simmer-sdk not installed. Run: pip install simmer-sdk")
            sys.exit(1)
        api_key = os.environ.get("SIMMER_API_KEY")
        if not api_key:
            print("Error: SIMMER_API_KEY environment variable not set")
            print("Get your API key from: simmer.markets/dashboard -> SDK tab")
            sys.exit(1)
        venue = os.environ.get("TRADING_VENUE", "kalshi")
        _client = SimmerClient(api_key=api_key, venue=venue, live=live)
    return _client

Technical Analysis

Skill metadata marks SOLANA_PRIVATE_KEY as a generally required environment variable, even though the documented default is dry-run mode and project code never reads the variable directly. This makes t ...[truncated 2431 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove SOLANA_PRIVATE_KEY from the unconditional Skill requirements.
  2. Request or inject signing authority only after the user explicitly selects --live.
  3. Ensure dry-run, configuration, and position-inspection modes execute without wallet key material in their environment.
  4. Prefer a dedicated signer process, hardware-backed signer, or narrowly scoped signing service over a raw private key environment variable.
  5. If environment-based provisioning cannot be avoided, use a dedicated low-value wallet and clear the variable before importing unrelated modules.
  6. Apply server-side spending, venue, transaction, and aggregate exposure limits that cannot be bypassed by local code.
  7. Document credential rotation and emergency revocation procedures.
  8. Keep signing authority separate from market discovery and other read-only network operations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

A private blockchain wallet key is an extremely sensitive credential, and requiring it in a context-inappropriate trading skill materially increases the likelihood of credential theft or unauthorized asset transfers. Because the skill context is Kalshi F1 market trading, the presence of a Solana private key requirement is more dangerous, not less, since there is no visible business justification for handling a wallet secret at all.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill requires access to sensitive environment variables, including high-value trading credentials, but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this weakens least-privilege controls and can allow a skill with financial capabilities to receive broader env access than operators expect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation inconsistently states that only SIMMER_API_KEY is required, while later sections also require SOLANA_PRIVATE_KEY. For a trading skill handling real funds, this can mislead reviewers and operators about the sensitivity of the skill, causing them to grant, store, or audit secrets improperly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest declares access to a raw private key but provides no visible warning, justification, or disclosure in the user-facing metadata. Even absent proven exfiltration code in this file, requesting such a sensitive secret without transparent disclosure creates a significant risk of users supplying credentials they do not understand the skill does not need.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest requests a SOLANA_PRIVATE_KEY even though the skill’s stated purpose is Kalshi F1 teammate-based trading and its listed dependency is only simmer-sdk. This mismatch is a strong indicator of unnecessary secret collection: if a user provides the key, the skill could access or drain an unrelated Solana wallet without any legitimate need tied to the advertised functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest and module docs describe a strategy based on teammate anti-correlation and relative mispricing between paired drivers. However, the implemented exit path closes positions whenever a market price exceeds EXIT_THRESHOLD, without evaluating teammate relationships or anti-correlation conditions at all. This is a meaningful strategy-behavior mismatch, not just an implementation detail.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

These lines describe implemented behavior ('default signal uses static dominance ratios' and 'the skill handles all the plumbing') as if the functionality exists. In the provided file, only documentation is present and there is no code implementing signal generation, market discovery, or trade execution, so the documentation overstates what this artifact itself does.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest describes trading F1 Drivers Championship markets on Kalshi using a teammate pricing thesis. In addition to trading, the skill actively searches for and imports Kalshi markets into Simmer via list_importable_markets and import_kalshi_market. While adjacent to trading, this is an extra operational behavior not stated in the skill description.

Content

No source excerpt is available for this finding.