Security audit

Kalshi Fed Temporal Mono Trader

Security checks for vulnerabilities and agentic risk

Overview

This real-money trading skill is mostly disclosed, but it asks for high-value credentials and can execute live trades with risk that is broader than its arbitrage framing suggests.

Review this before installing. Use only paper mode unless you intentionally want automated real-money trading, and do not provide a main Solana wallet private key. If used at all, use a dedicated low-balance wallet and tightly limited trading credentials. Treat the strategy as speculative unless the implementation is changed to validate and execute both legs of the claimed arbitrage.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: clawhub.json:3
Finding: Unnecessary Exposure of the Solana Wallet Private Key
Content: View full analysis
SDK tab") sys.exit(1) venue = os.environ.get("TRADING_VENUE", "kalshi") _client = SimmerClient(api_key=api_key, venue=venue, live=live) return _client ``` ### Technical Analysis The Skill declares `SOLANA_PRIVATE_KEY` as a required environment variable, but the audited `trader.py` implementation never reads or directly uses that credential. All authenticated trading operations are performed through a `SimmerClient` initialized with `SIMMER_API_KEY`. Requiring an unused wallet private key violates the principle of least privilege. Supplying the key makes it available in the process environment, where imported Python modules and other code running under the same process identity may access it through `os.environ`. This is especially concerning because the Skill imports a third-party trading SDK and optional trade-journal modules. The static pre-scan warning about sensitive information sent over the network appears primarily attributable to the API key being passed to th ...[truncated 1265 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: clawhub.json:10
Finding: Unpinned Third-Party Dependency Runs with Trading Credentials
Content: View full analysis
SDK tab") sys.exit(1) venue = os.environ.get("TRADING_VENUE", "kalshi") _client = SimmerClient(api_key=api_key, venue=venue, live=live) return _client ``` ### Technical Analysis The Skill requests `simmer-sdk` without an exact version, lock file, or package hash. Package resolution may therefore install a newer release than the one originally reviewed. The dependency is security-sensitive because it executes at import time, receives `SIMMER_API_KEY`, performs network requests, imports markets, retrieves positions, and submits trades. Under the current manifest, its process may also contain `SOLANA_PRIVATE_KEY`, even though `trader.py` does not use that key directly. An unpinned dependency is not evidence that the current package is malicious. The vulnerability is that the effective trusted code can change after review without a corresponding change to this project. Compromise of the publisher account, package ...[truncated 1290 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: trader.py:317
Finding: Documented Arbitrage Is Executed as an Unhedged Directional Trade
Content: View full analysis
" f"{v['late_month']}={v['late_price']:.1%} diff={violation_size:.1%}"), signal_data={ "violation_size": round(violation_size, 4), "early_month": v["early_month"], "late_month": v["late_month"], "early_price": round(v["early_price"], 4), "late_price": round(v["late_price"], 4), }, ) ``` ### Technical Analysis The documentation characterizes the strategy as a pure structural arbitrage with ma ...[truncated 2463 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description materially understates behavior: it claims a simple Fed cut arbitrage strategy using one credential, but the content also describes trading hike markets, live execution, position management, market discovery/import, and use of an additional private key. This mismatch is dangerous because users or orchestrators may approve or auto-run the skill under an inaccurate risk model, exposing live funds and high-value credentials to a workflow they did not knowingly authorize.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Declaring blockchain private-key access without justification from the stated Kalshi-only trading purpose is a strong indicator of over-privileged design. In skill ecosystems, unnecessary signing credentials are especially dangerous because they can enable theft of funds, unauthorized transfers, or hidden secondary behavior outside the user's expectations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares required environment-backed credentials but provides no explicit tool scope or permissions boundary in the manifest. In an agent ecosystem, this can allow broader-than-expected access to sensitive secrets such as SIMMER_API_KEY and SOLANA_PRIVATE_KEY, increasing the chance of unintended credential exposure or misuse during execution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest requests SOLANA_PRIVATE_KEY even though the skill description and dependencies describe only a Kalshi Fed-market trading strategy. Unnecessary access to a blockchain private key materially increases the blast radius: a compromised or malicious skill could use that secret to sign arbitrary on-chain transactions unrelated to the advertised purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest requests a private key but provides no user-facing disclosure in the metadata that sensitive signing credentials will be consumed. This lack of transparency makes social-engineering and mis-consent more likely, because users may provide a highly sensitive secret to a skill whose description implies only conventional market-data/trading API access.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest description is narrowly framed around the invariant 'P(rate cut by June) >= P(rate cut by April)' and arbitrage on cut markets. However, the implementation explicitly defines rate-hike market detection and later includes hike markets in discovery, grouping, violation detection, and trading, which expands behavior beyond the stated purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: In live mode, the script places real trades immediately based solely on the --live flag, without an interactive confirmation, countdown, or explicit high-visibility warning at the point of execution. In an automation-heavy trading context, this increases the chance of accidental real-money execution from operator error, bad deployment defaults, or misuse by another tool invoking the skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest context lists only SIMMER_API_KEY and simmer-sdk as requirements, implying a limited credential footprint. The file's own module docstring says live trading requires SOLANA_PRIVATE_KEY, meaning the actual operational requirements are broader than the manifest describes.
Content: No source excerpt is available for this finding.