pp-kalshi

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the kalshi-pp-cli tool using npx from the @mvanhorn NPM scope and via go install from the github.com/mvanhorn/printing-press-library repository. These sources are consistent with the skill's vendor context and are documented neutrally.
  • [COMMAND_EXECUTION]: The primary function of this skill is to execute the kalshi-pp-cli binary to perform market analysis and portfolio management. The commands are clearly defined in the documentation and follow a standard CLI structure.
  • [CREDENTIALS_UNSAFE]: While the skill interacts with API keys (KALSHI_API_KEY and KALSHI_PRIVATE_KEY), it follows best practices by instructing the agent to use environment variables or local paths rather than hardcoding secrets. It also explicitly mentions a --read-only flag to prevent unauthorized mutations.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external market data from the Kalshi API and local SQLite snapshots. However, it uses structured output (JSON) and defined command structures, minimizing the surface for prompt injection attacks.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 12:35 AM