kalshi
Verdict safe, but 1 finding (1 medium), mainly data exfiltration. Most recent scan 2026-02-06.
The Kalshi prediction markets skill is a READ-ONLY integration that appears to be legitimately designed for viewing market data and portfolio positions. The skill correctly implements authentication using the official Kalshi Python SDK with RSA key signing. No critical security threats were identified - there is no data exfiltration, no prompt injection attempts, no command injection vulnerabilities, and no malicious code obfuscation. The skill's behavior matches its description as a read-only market analysis tool. The main concerns are around credential storage practices (MEDIUM severity) and missing optional metadata fields (LOW severity). The skill makes legitimate API calls to Kalshi's official endpoints and does not attempt to send data to unauthorized third parties. Internal file references (api.md) are normal for a self-contained skill package. Overall, this skill demonstrates good security practices for a financial data integration tool.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Read-only Kalshi prediction market integration. Use for viewing markets, checking portfolio positions, analyzing prediction opportunities, and finding high-payoff/high-certainty trades. Triggers on Kalshi, prediction markets, event contracts, or trading recommendations.
- Package
- 4 files, 23 KB
- SKILL.md
- 322 words, 12+ sections
- Code
- Python (2)
SKILL.md covers: Kalshi Prediction Markets · Capabilities · Setup · Scripts · Market Data (No Auth Required) · List trending markets · Search markets by query · Get specific market details · Find high-value opportunities · Portfolio (Auth Required) · View positions · View balance
Findings
MEDIUM Credential Storage in User Home Directory Data Exfiltrationllm
The skill stores API credentials (API key ID and private key) in ~/.kalshi/ directory with JSON configuration file. While this is a common pattern, it creates a centralized credential store that could be targeted by other malicious skills or processes. The private key file is set to 600 permissions (user-only read/write), which is good, but the credentials.json file permissions are not explicitly set.
SKILL.md
```bash
mkdir -p ~/.kalshi
mv ~/Downloads/your-key-file.txt ~/.kalshi/private_key.pem
chmod 600 ~/.kalshi/private_key.pem
```
```json
{
"api_key_id": "your-key-id-here",
"private_key_path": "~/.kalshi/private_key.pem"
}
```What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 2.8 KB |
references/api.md | doc | 2.1 KB |
scripts/kalshi_markets.py | script | 11 KB |
scripts/kalshi_portfolio.py | script | 7.2 KB |
External hosts referenced
api.elections.kalshi.com kalshi.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/kalshi
- Raw scan result: kalshi-scan.json
- Badge for your README:
- Request a re-scan