Polymarket Kalshi Divergence

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  2.0.5

Overview

This is a disclosed market-scanning trading bot that defaults to dry run, but users should understand that live mode can place automated trades.

Use dry-run and the default simulated venue first. Only set TRADING_VENUE to a real venue or run with --live if you accept automated financial risk, and keep KALSHI_TRADE_SIZE and thresholds conservative. Monitor the five-minute automaton schedule and disable it when you no longer want scans or trades.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: When run with --live, the skill places real trades immediately for every generated signal without an explicit human confirmation, approval gate, or secondary safety interlock. In a trading skill, this is materially risky because heuristic market matching and pricing errors can directly trigger unintended financial transactions.

VirusTotal

66/66 vendors flagged this skill as clean.