ClawHub
Back to skill

Security audit

kalshi-weather-trader

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real Kalshi weather-trading tool, but its live-trading safeguards can fail open and it relies on an unpinned SDK while handling wallet-signing credentials.

Review carefully before installing with real funds. Use a dedicated low-balance wallet and narrowly scoped API key if available, keep dry-run mode until behavior is verified, pin or review the simmer-sdk version before use, and do not rely on the advertised safeguards unless the fail-open behavior is fixed or acceptable for your risk tolerance.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:41
Finding

Unpinned High-Privilege Trading Dependency

Content
View full analysis
Remediation
View remediation
\ --hash=sha256: ``` 3. Ensure automated installation uses a trusted, explicitly configured package index and rejects unexpected fallback indexes. 4. Record the reviewed SDK version and package hash in release documentation. 5. Re-audit SDK updates before changing the pin, particularly credential handling, transaction construction, and signing behavior. 6. Run the trading process with a minimal environment and operating-system permissions so the SDK cannot access unrelated credentials or files. 7. Where supported, use narrowly scoped API credentials and a dedicated low-balance wallet to limit the impact of dependency compromise. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
weather_trader.py:363
Finding

Live Trading Safeguards Fail Open When Market Context Is Unavailable

Content
View full analysis
dict: """Get market context with safeguards and optional edge analysis.""" try: if my_probability is not None: return get_client()._request("GET", f"/api/sdk/context/{market_id}", params={"my_probability": my_probability}) return get_client().get_market_context(market_id) except Exception: return None ``` `weather_trader.py:394-404`: ```python def check_context_safeguards(context: dict, use_edge: bool = True, min_hours: float = None) -> tuple: """ Check context for safeguards. Returns (should_trade, reasons). Args: context: Context response from SDK use_edge: If True, respect edge recommendation (TRADE/HOLD/SKIP) min_hours: Time-decay floor in hours. Defaults to the entry knob; exits pass EXIT_MIN_HOURS_TO_RESOLVE. """ if not context: return True, [] # No context = proceed (fail open) ``` ### Technical Analysis `get_market_context()` catches every exception and converts it into `None`, suppressing the cause and preventing callers from distinguishing an unavailable service from a valid response. `check_context_safeguards()` then explicitly treats a missing or empty context as approval to trade. As a result, the following controls are bypassed whenever the context request fails or returns an empty response: - Resolved-market detection - Severe flip-flop blocking - Time-to-resolution restrictions - Minimum-liquidity enforcement - Maximum-slippage enforcement - Edge recommendations This behavior contradicts the expectation created by leaving safeguards enabled. ...[truncated 1566 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as an automated Kalshi weather trading tool that uses NOAA, DFlow, and Solana, yet the finding indicates the implemented behavior does not perform those actions and instead focuses on account or portfolio inspection. This mismatch is security-relevant because users may grant high-risk secrets and trust assumptions suitable for trading automation to a skill that behaves differently, undermining informed consent and security review.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill explicitly requires sensitive environment variables, including a Solana private key, and instructs use of networked APIs, but it does not declare any tool scope or permissions boundary. In an agent framework, missing explicit scope makes the skill harder to sandbox and review, increasing the chance of unintended secret access or outbound requests when installed or invoked.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
4. **Verify KYC**
   - Required for Kalshi buys (not sells)
   - Complete at [dflow.net/proof](https://dflow.net/proof)
   - Check status: `curl "https://api.simmer.markets/api/proof/status?wallet=YOUR_SOLANA_ADDRESS"`

5. **Fund the wallet**
   - SOL on Solana mainnet for transaction fees (~0.01 SOL)

Static analysis

No suspicious patterns detected.