{
  "skill_name": "kalshi",
  "skill_path": "/workspace/skills/clawhub-kalshi",
  "skill_directory": "/workspace/skills/clawhub-kalshi",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 1,
  "findings": [
    {
      "id": "llm_finding_kalshi_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Credential Storage in User Home Directory",
      "description": "The skill stores API credentials (API key ID and private key) in ~/.kalshi/ directory with JSON configuration file. While this is a common pattern, it creates a centralized credential store that could be targeted by other malicious skills or processes. The private key file is set to 600 permissions (user-only read/write), which is good, but the credentials.json file permissions are not explicitly set.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "```bash\nmkdir -p ~/.kalshi\nmv ~/Downloads/your-key-file.txt ~/.kalshi/private_key.pem\nchmod 600 ~/.kalshi/private_key.pem\n```\n\n```json\n{\n  \"api_key_id\": \"your-key-id-here\",\n  \"private_key_path\": \"~/.kalshi/private_key.pem\"\n}\n```",
      "remediation": "1. Document that credentials.json should also have restrictive permissions (chmod 600)\n2. Add validation in scripts to check file permissions before reading credentials\n3. Consider using system keychain/credential managers instead of plain JSON files\n4. Add warning in documentation about credential security",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "The Kalshi prediction markets skill is a READ-ONLY integration that appears to be legitimately designed for viewing market data and portfolio positions. The skill correctly implements authentication using the official Kalshi Python SDK with RSA key signing. No critical security threats were identified - there is no data exfiltration, no prompt injection attempts, no command injection vulnerabilities, and no malicious code obfuscation. The skill's behavior matches its description as a read-only market analysis tool. The main concerns are around credential storage practices (MEDIUM severity) and missing optional metadata fields (LOW severity). The skill makes legitimate API calls to Kalshi's official endpoints and does not attempt to send data to unauthorized third parties. Internal file references (api.md) are normal for a self-contained skill package. Overall, this skill demonstrates good security practices for a financial data integration tool.",
        "primary_threats": [
          "Credential storage in home directory without explicit permission controls",
          "Missing optional metadata (allowed-tools, license, compatibility)"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "The LLM analyzer missed that permissions ARE set in the code (line 177: os.chmod(CREDENTIALS_PATH, 0o600)). However, the concern about credential storage location is valid - storing in ~/.kalshi creates a known target location.",
        "meta_exploitability": "Medium - Requires local file system access to ~/.kalshi directory",
        "meta_impact": "Medium - Could expose API credentials if attacker has local access, but credentials are already protected with 0o600 permissions"
      }
    }
  ],
  "scan_duration_seconds": 31.480368852615356,
  "duration_ms": 31480,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-06T03:43:28.770302"
}