Foreseek AI

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI02: Tool Misuse and Exploitation

What this means

A mistaken or overly broad agent action could place real-money prediction-market trades or cancel orders in the user's account.

Why it was flagged

The skill documents a direct API operation that places real orders on a connected Kalshi account, including market orders. The provided artifacts do not show mandatory user confirmation, spend limits, or price/slippage controls before this high-impact action.

Skill content

### Execute a Trade

Places an order on Kalshi through your connected account.
...
"operation": "trade",
"ticker": "KXFED-25MAR-T475",
"side": "yes",
"action": "buy",
"count": 10,
"type": "market"

Recommendation

Only use this with explicit per-order confirmation that states ticker, side, action, quantity, order type, maximum price/cost, and whether the account is demo or live. Prefer limit orders and small caps.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent workflow with access to this key may be able to view account information and perform trading actions supported by the Foreseek API.

Why it was flagged

The skill requires a Foreseek API key and uses it as a bearer token for operations tied to a connected Kalshi account. This is expected for the stated trading purpose, but it is sensitive delegated account authority.

Skill content

requires:
  env:
    - FORESEEK_API_KEY
...
-H "Authorization: Bearer $FORESEEK_API_KEY"
...
"kalshi_connected": true

Recommendation

Use the least-privileged key available, rotate it if exposed, verify whether it is connected to a live or demo Kalshi account, and avoid enabling autonomous use for trade execution.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The user must trust the external Foreseek backend with their API key and trading/account requests.

Why it was flagged

All operations are sent to an external Supabase function endpoint. This is plausible provider infrastructure, but because the supplied package has no code files or install spec, the backend's handling of credentials, trades, and account data cannot be reviewed here.

Skill content

curl -X POST https://jxvtetqmzduvhgiyldgp.supabase.co/functions/v1/foreseek-cli

Recommendation

Verify the endpoint through Foreseek's official documentation or dashboard before using it, and do not provide credentials if the service origin cannot be confirmed.