Scan Report
5 /100
kalshi-eth-btc-beta-trader
Trades ETH price markets on Kalshi by exploiting the 1.3x beta relationship between ETH and BTC. Detects BTC probability shifts and trades lagging ETH markets.
A well-documented Kalshi ETH-BTC beta trading bot that makes authenticated API calls to Simmer Markets; no malicious behavior, no hidden functionality, and no credential exfiltration.
Safe to install
No action needed. The skill is safe to use. As a precaution, do not provide live trading credentials unless you have independently audited the simmer-sdk dependency.
Findings 1 items
| Severity | Finding | Location |
|---|---|---|
| Low | Unpinned PyPI dependency | clawhub.json:2 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | READ | ✓ Aligned | trader.py:42 - load_config reads skill config file only |
| Network | READ | READ | ✓ Aligned | trader.py:231-247 - GET /api/sdk/markets, /api/sdk/context, /api/sdk/positions |
| Shell | NONE | NONE | — | No subprocess, os.system, or shell execution calls found |
| Environment | WRITE | WRITE | ✓ Aligned | Reads SIMMER_API_KEY, SOLANA_PRIVATE_KEY, TRADING_VENUE, AUTOMATON_* vars |
| Skill Invoke | NONE | READ | ✓ Aligned | trader.py:27-32 - tries to import tradejournal skill if available |
2 findings
Medium External URL 外部 URL
https://simmer.markets/skills SKILL.md:10 Info Email 邮箱地址
[email protected] SKILL.md:128 File Tree
3 files · 33.0 KB · 944 lines Python 1f · 707L
Markdown 1f · 130L
JSON 1f · 107L
├─
clawhub.json
JSON
├─
SKILL.md
Markdown
└─
trader.py
Python
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
simmer-sdk | * | pip | No | Version not pinned — could resolve to a compromised future version |
Security Positives
✓ SKILL.md is thorough and accurately describes all functionality — no doc-to-code mismatch
✓ No shell execution, subprocess, or os.system calls anywhere in the codebase
✓ No credential exfiltration — API keys are used only for Simmer API authentication
✓ No filesystem write operations — only reads config file via SDK helper
✓ No base64, eval, or dynamic code execution
✓ No access to sensitive local paths (~/.ssh, ~/.aws, .env)
✓ No external IP connections except to documented Simmer API endpoints
✓ Dry-run mode is the default, requiring explicit --live flag for real trades
✓ Trade journal integration is optional and gracefully degrades if unavailable
✓ No hidden instructions in comments or strings