Portfolio Drift Monitor
ReviewAudited by ClawScan on May 10, 2026.
Overview
This is mostly a coherent Kalshi portfolio monitor, but it uses financial account credentials and includes an under-documented Slack webhook path that could send portfolio alert details outside the local machine.
Review before installing. Use a dedicated least-privilege Kalshi API key if possible, protect the private key and snapshot file, and remove or avoid configuring OPENCLAW_SLACK_WEBHOOK/slack_webhook_url unless you intentionally want portfolio alerts sent to Slack. Verify the full script and settings before enabling hourly scheduled monitoring.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill can use the configured Kalshi API key to read portfolio positions.
The skill needs local Kalshi API credentials and a private key file to access the user's portfolio. This is expected for the stated purpose, but it is high-impact financial account access and the registry metadata says no primary credential or required env vars.
Kalshi API credentials: `KALSHI_KEY_ID` and `KALSHI_KEY_PATH` environment variables ... API key file ... `~/.kalshi/key.pem`
Use the least-privileged or read-only Kalshi key available, keep the PEM file permission-restricted, and declare the credential requirements in metadata.
Portfolio alert details such as tickers, position changes, or P&L could be sent to a Slack workspace if a webhook is configured.
The source includes a Slack webhook notification path that can post alert text to a configured webhook. The visible README/SKILL documentation focuses on local output and does not clearly document this external data flow.
webhook_url = os.getenv("OPENCLAW_SLACK_WEBHOOK") ... webhook_url = config.get("slack_webhook_url") ... urllib.request.urlopen(req, timeout=5)Document Slack behavior prominently, make it explicit opt-in for this skill, declare the webhook env/config inputs, and avoid sending sensitive portfolio details unless the user approves the destination.
Anyone or any process with access to the local state file may be able to view prior portfolio details.
The skill persists portfolio position data locally so future checks can compare drift. The path and structure are disclosed and bounded, but the file contains sensitive financial data.
Location `~/.openclaw/state/portfolio_snapshot.json` ... `shares` ... `pnl` ... `risk`
Keep the state directory private, avoid syncing it to shared storage, and delete the snapshot file when resetting or uninstalling the monitor.
Once scheduled, the skill may keep checking the Kalshi account in the background at the configured interval.
The documentation supports recurring scheduled execution. This is aligned with monitoring, but it is persistent account polling that continues until the schedule is disabled.
schedule: "0 * * * *" # Every hour
Enable scheduling only after validating credentials, threshold, alert destination, and rate limit settings; disable the schedule when monitoring is no longer needed.
The skill may fail until dependencies are installed, and users must ensure packages are installed from a trusted Python environment.
The skill ships code and requirements but no install spec, so dependency installation is manual. The requirements file pins package versions, which reduces but does not remove setup/provenance risk.
No install spec — this is an instruction-only skill.
Install dependencies from the pinned requirements file in an isolated environment and add an explicit install spec if publishing for routine use.