Kalshi

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:03 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed Kalshi market and portfolio viewer, with the main caution that portfolio features use local API credentials and reveal account data.

Install this only if you want a local Python-based Kalshi viewer. Public market commands do not need credentials; portfolio commands require a Kalshi API key/private key and will expose balances, positions, orders, and trade history to the session. Protect ~/.kalshi files, use the least-privileged key available, verify Python dependencies before installing, and treat opportunity output as speculative rather than financial advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares itself as read-only but its documented setup and usage require shell execution, network access, and local file writes for credential storage. Undeclared capabilities increase risk because users or orchestrators may invoke the skill without understanding it can modify the filesystem and handle sensitive material.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The 'read-only' label is misleading because the skill performs sensitive local actions: moving a private key, writing credentials, changing permissions, and using authenticated account access. Even if no trades are executed, this expands the trust boundary from passive market viewing to local secret management, which can expose credentials or trigger unintended privileged operations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill is described as read-only, but it includes a setup workflow that writes API credential configuration to disk. While the script does not appear to place orders, collecting and persisting authentication material expands the trust boundary and creates a mismatch between declared capability and actual secret-handling behavior.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Interactive credential collection and local secret configuration are not necessary for merely viewing or analyzing market data unless clearly justified and documented. This increases the chance that users will enter sensitive identifiers into an agent-managed context and persist them locally without understanding the security implications.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger scope includes broad terms like prediction markets, event contracts, and trading recommendations, which can cause the skill to activate in unrelated finance conversations. Overbroad triggering is dangerous because it can unexpectedly steer users into running market-analysis or credential-related commands in contexts where they did not intend to use this integration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The setup instructions direct users to move a private key into a fixed location and create a credentials file, but they do not clearly warn that these are highly sensitive secrets whose compromise could expose account data and authenticated API access. In a skill context, omission of explicit secret-handling guidance makes accidental leakage, insecure backups, or misuse more likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code explicitly markets outputs as 'high-certainty, high-payoff opportunities' and prints 'Found X opportunities' without any warning that these are speculative heuristics, not financial advice. In a prediction-market skill, this can mislead users into acting on oversimplified expected-return calculations, increasing risk of financial loss.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes a credential file to disk and sets file permissions, but it does not warn the user that API identifiers and key paths are being stored locally or explain the associated risks. This can lead to unintended persistence of sensitive account linkage data on shared or insufficiently secured systems.

Credential Access

High

• Category: Privilege Escalation

Content

except ImportError:
    HAS_SDK = False

CREDENTIALS_PATH = Path.home() / ".kalshi" / "credentials.json"


def load_credentials() -> dict:

• Confidence: 88% confidence
• Finding: credentials.json

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.