Trust Assessment
kalshi received a trust score of 66/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 3 findings: 0 critical, 2 high, 1 medium, and 0 low severity. Key findings include Suspicious import: requests, Unpinned Third-Party Dependencies, Unpinned Third-Party Dependencies (kalshi-python).
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings3
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Unpinned Third-Party Dependencies The skill's setup instructions recommend installing third-party Python packages (`requests`, `cryptography`, `kalshi-python`) without specifying exact versions. This introduces a supply chain risk, as a future malicious or vulnerable update to any of these packages could compromise the skill or the system running it. The `kalshi-python` SDK is particularly critical as it handles sensitive API keys and private keys. Pin all third-party dependencies to specific, known-good versions (e.g., `pip install requests==2.28.1 cryptography==3.4.8 kalshi-python==1.2.3`). Regularly review and update these pinned versions after verifying their integrity and security. Consider using a `requirements.txt` file with hashed dependencies. | LLM | SKILL.md:19 | |
| HIGH | Unpinned Third-Party Dependencies (kalshi-python) The `kalshi_portfolio.py` script relies on the `kalshi-python` SDK, which is installed without a pinned version as per the `SKILL.md` instructions. This library is responsible for handling API key IDs and private keys for authentication. An unpinned dependency creates a significant supply chain risk, as a compromised or vulnerable future version of `kalshi-python` could lead to credential compromise or other security breaches. Pin the `kalshi-python` dependency to a specific, known-good version in the installation instructions (e.g., `pip install kalshi-python==X.Y.Z`). Regularly review and update this pinned version after verifying its integrity and security. Consider using a `requirements.txt` file with hashed dependencies. | LLM | scripts/kalshi_portfolio.py:10 | |
| MEDIUM | Suspicious import: requests Import of 'requests' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/henrik-openclaw/kalshi/scripts/kalshi_markets.py:12 |
Scan History
Embed Code
[](https://skillshield.io/report/df2f167e173d1ff0)
Powered by SkillShield