Kalshi CLI Trading

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:35 AM UTC
• Version: 1.0.0

Overview

This is a coherent Kalshi trading skill, but it deserves review because it installs an unpinned third-party trading CLI that handles credentials and can place or cancel real-money orders, including non-interactive orders.

Review the exact kalshi-cli version and source before installing, prefer a pinned verified release, use demo mode first, keep production trading behind explicit human approval, avoid --yes for live orders unless you have a reviewed bot workflow, and use narrowly scoped Kalshi credentials that can be revoked quickly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned External Trading CLI Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-37; also referenced in README.md:25
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:20-37:

bash

## Installation

### macOS / Linux (Homebrew)
```bash
brew install 6missedcalls/tap/kalshi-cli

Go Install (requires Go 1.25+)

bash

go install github.com/6missedcalls/kalshi-cli/cmd/kalshi-cli@latest

Build from Source

bash

git clone https://github.com/6missedcalls/kalshi-cli.git
cd kalshi-cli
go build -o kalshi-cli ./cmd/kalshi-cli

text

`README.md:25`:

```bash
brew install 6missedcalls/tap/kalshi-cli

Technical Analysis

The Skill delegates authentication, account-data access, and financial trading operations to the externally installed kalshi-cli executable. The documented installation methods use mutable or insufficiently pinned sources:

• A third-party Homebrew tap without a documented package checksum or signature.
• Go installation using the mutable @latest selector.
• A Git clone of the repository's default branch without a pinned commit or release tag.

The audited project does not include the CLI source and does not specify a verified release version, commit hash, cryptographic checksum, or trusted signature. Consequently, the executable installed by a user can differ from the executable reviewed when the Skill was published.

This risk is particularly significant because the CLI is instructed to receive Kalshi API credentials, access balances and positions, and submit, amend, or cancel orders. The Skill also documents production mode and non-interactive confirmation bypasses. No evidence shows that the current upstream dependency is malicious; the vulnerability is the absence of reproducible and integrity-verified dependency resolution.

Attack Path

1. An attacker compromises the upstream GitHub repository, Homebrew tap, rel ...[truncated 1730 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an explicitly audited semantic version:

   bash

   go install github.com/6missedcalls/kalshi-cli/cmd/kalshi-cli@vX.Y.Z
   

2. Pin source builds to a reviewed commit or signed release tag:

   bash

   git clone --branch vX.Y.Z --depth 1 https://github.com/6missedcalls/kalshi-cli.git
   cd kalshi-cli
   git verify-tag vX.Y.Z
   

3. Publish expected SHA-256 checksums for supported binaries and require verification before execution.

4. Prefer signed release artifacts and document how users can validate the publisher's signing identity.

5. Pin the Homebrew formula to an audited release whose source URL and checksum are immutable. Document the exact expected formula version.

6. Add the audited CLI version and commit hash to _meta.json or a dependency lock manifest so Skill releases are reproducible.

7. Validate the pinned dependency in demo mode before permitting production use.

8. Recommend narrowly scoped API credentials where supported. Users should rotate or revoke credentials immediately if dependency integrity is uncertain.

9. Avoid passing private-key material directly through command-line arguments. Prefer protected key files or operating-system keyrings with restrictive permissions.

10. Preserve the existing requirement for explicit confirmation before production trading, and do not use --yes for real-money operations unless the user has explicitly authorized a separately reviewed automation workflow.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README shows a live-money production trade command immediately after demo examples, but without a prominent, adjacent warning that --prod switches from fake funds to real-money execution. In a trading skill, that omission can cause accidental live trades by users or agents that copy commands verbatim, leading to unintended financial loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The command cheat sheet includes order cancellation commands, including cancel-all, without an explicit warning about their destructive operational impact. While cancellation is not code execution, in a trading context it can abruptly remove protective or strategic orders and materially affect positions, execution quality, or risk management.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill explicitly documents use of --yes to suppress confirmation prompts for order placement, enabling unattended execution of trades. In a trading skill, that increases the risk of accidental or manipulated real-money orders, especially when combined with automation or environment-based production settings.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

kalshi-cli orders create --market KXBTC-26FEB12-B97000 --side no --qty 5 --price 30 --action sell

text

**Skip confirmation (for bots):**
```bash
kalshi-cli orders create --market KXBTC-26FEB12-B97000 --side yes --qty 10 --price 50 --yes --json

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

kalshi-cli orders queue ORDER_ID # check queue position

text

**Batch create orders from JSON file:**
```bash
kalshi-cli orders batch-create --file orders.json

Static analysis

No suspicious patterns detected.