Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Kalshi Trader

v1.0.0

Automated Kalshi prediction market trading bot. Sets up a fully automated trading system that scans markets every 15 minutes, researches opportunities using...

0· 116·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for bobthemom987/kalshi-trader.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Kalshi Trader" (bobthemom987/kalshi-trader) from ClawHub.
Skill page: https://clawhub.ai/bobthemom987/kalshi-trader
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install kalshi-trader

ClawHub CLI

Package manager switcher

npx clawhub@latest install kalshi-trader
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name and description promise a fully automated Kalshi trading bot that researches, places trades, monitors positions, and sends Telegram summaries. The code (scripts/kalshi_bot.py) supports authenticated API calls and has helper functions to place orders and log trades, which is consistent with a trading tool, but the main CLI only scans markets, prints candidates, and provides a summary — it does not perform automatic research, autonomous trade placement, position monitoring, or Telegram notifications as claimed. Storing an RSA private key and key id is appropriate for signing Kalshi requests, so those credential requirements are proportionate to a trading bot, but the overall capability is overstated compared to the implementation.
!
Instruction Scope
SKILL.md instructs installation, creating ~/.kalshi private key files, setting up cron jobs that run every 15 minutes and daily summaries, and directs the agent to use web_fetch/web_search for research. The instructions also describe strict entry/exit rules and research workflows not enforced by the code. The cron prompt and docs reference automated behavior and notification-only-on-trade semantics, but the shipped script will not autonomously execute trades or send Telegram messages. Also, references/api.md shows reading keys from /root/.kalshi while the code uses the user's home (~/.kalshi) — a path inconsistency. The install step suggests using pip with --break-system-packages which is an unusual flag to include in a generic README and may confuse less experienced users.
Install Mechanism
There is no packaged install spec; SKILL.md instructs the user to run pip install cryptography requests. That is reasonable for a Python script, but the explicit use of the pip flag --break-system-packages is atypical and should be reconsidered or explained. Because this is instruction-only with a small script, there is no archive download or opaque install URL — lower installation risk overall.
Credentials
The skill does not request environment variables or unrelated credentials. It explicitly asks the user to store an RSA private key and a key id in ~/.kalshi which matches the Kalshi API auth mechanism shown in references/api.md. The only proportionality concern is the inconsistent example path in references/api.md (/root/.kalshi) versus the script and SKILL.md (~/.kalshi). The skill writes a local log (~/kalshi_trades.json) which is expected for trading history but may contain sensitive trade data.
Persistence & Privilege
always is false; the skill does not request elevated or persistent platform-wide privileges. It only reads ~/.kalshi files and writes a local log file. It does not modify other skills or system-wide configurations. Autonomous invocation (disable-model-invocation=false) is normal but not combined with other high-risk flags.
What to consider before installing
This package contains a plausible Kalshi client and sensible trading rules, but it does NOT implement the full automated behavior described in the docs (no auto-research, no automatic order execution loop, no Telegram reporting). Before installing or running: 1) Treat the RSA private key you create as highly sensitive — store it with strict permissions and do not run the bot as root. 2) Inspect the script yourself (it’s small) and test with the 'test' command to confirm API connectivity. 3) If you expect fully automated trading or Telegram notifications, implement and review those features first — the current code will only scan and print candidates. 4) Fix the path inconsistency (/root/.kalshi vs ~/.kalshi) in docs to avoid misplacing keys. 5) Remove or explain the pip --break-system-packages flag if you are not using a constrained environment. 6) Run initial scans in a limited/test account or sandbox and monitor activity (cron jobs should be configured only after you trust the behavior). If you want, ask for a follow-up review after the author supplies a version that actually performs autonomous trading and reporting so I can re-evaluate.

Like a lobster shell, security has layers — review code before you run it.

latestvk97d7dapn2epmp8g4htt1vj9b183tcxz
116downloads
0stars
1versions
Updated 4w ago
v1.0.0
MIT-0

Kalshi Trader

Automated prediction market trading on Kalshi. Scans every 15 minutes, researches before every trade, reports daily via Telegram.

Setup (run once)

1. Install dependencies

pip install cryptography requests --break-system-packages

2. Store Kalshi credentials

mkdir -p ~/.kalshi && chmod 700 ~/.kalshi
nano ~/.kalshi/private_key.pem   # paste -----BEGIN RSA PRIVATE KEY----- block
chmod 600 ~/.kalshi/private_key.pem
echo "YOUR-API-KEY-ID-HERE" > ~/.kalshi/key_id.txt
chmod 600 ~/.kalshi/key_id.txt

Get your API key at: kalshi.com → Settings → API → Create Key

3. Deploy the bot

cp scripts/kalshi_bot.py ~/kalshi_bot.py
chmod 600 ~/kalshi_bot.py

4. Test connection

python3 ~/kalshi_bot.py test

5. Set up cron jobs (via OpenClaw cron tool)

15-minute scan (silent unless trade placed or exited):

  • Schedule: */15 * * * *
  • Message: see references/cron-prompt.md

Daily summary (9am your timezone):

  • Schedule: 0 9 * * * with your timezone
  • Message: "Run python3 ~/kalshi_bot.py summary and send daily trading report with balance, open positions, recent trades, P&L, and fees paid."

Trading Rules

Entry criteria

Only place a trade if EV IRR ≥ 50% (post-fee):

edge = fair_value - (market_price + entry_fee)
EV IRR = (edge / (market_price + entry_fee)) × (365 / days_to_close)

Minimum: EV IRR ≥ 0.50 (50%)

Position sizing — Half Kelly

kelly_fraction = (edge / market_price) × 0.5
max_position = min(kelly_fraction × balance, 0.20 × balance)
contracts = floor(max_position / market_price)

Exit rule

Exit ONLY if current bid ≥ fair value estimate (net of exit fee).

  • Never use price-based stop losses — prediction markets resolve on facts, not on what other traders think
  • If price drops, research whether the underlying facts changed
  • Only exit early if: (a) price reached fair value, or (b) new evidence shows the outcome is unlikely

Research approach

Use web_fetch as primary research tool (no quota limits). Known data sources:

  • Gas prices: https://gasprices.aaa.com/
  • Trump actions: https://www.whitehouse.gov/presidential-actions/
  • Treasury yields: https://home.treasury.gov/resource-center/data-chart-center/interest-rates/
  • Bitcoin/crypto: https://api.coingecko.com/api/v3/simple/price?ids=bitcoin&vs_currencies=usd
  • Weather: https://wttr.in/CityName?format=3
  • Congress bills: https://www.congress.gov

Only use web_search for open-ended research where the URL isn't known upfront.

Bot Commands

python3 ~/kalshi_bot.py          # scan for opportunities
python3 ~/kalshi_bot.py summary  # print P&L summary  
python3 ~/kalshi_bot.py test     # verify API connection

Reporting format (include in every update)

  • 💰 Cash balance
  • 📦 Total position cost
  • 📈 Current market value of positions
  • 💹 Unrealized P&L
  • 💸 Total Kalshi fees paid
  • 🏦 Total portfolio value

API reference

See references/api.md for Kalshi authentication and endpoints.

Trade research workflow

See references/trade-research.md for finding and evaluating opportunities.

Comments

Loading comments...