kalshi-trading-bot-cli

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill's installation/setup instructions explicitly fetch and run remote code (e.g., "git clone https://github.com/OctagonAI/kalshi-trading-bot-cli.git" followed by bun install / bun start, and the equivalent bunx kalshi-trading-bot-cli@latest), so the repository URL https://github.com/OctagonAI/kalshi-trading-bot-cli.git is a runtime external dependency that will execute remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a trading CLI for Kalshi with built-in commands to place and manage orders (buy, sell, cancel) and requires trading credentials (KALSHI_API_KEY and private key). It documents live vs demo modes, exact state-changing command syntax, safety checks, and examples of running live orders (including a demo-mode and live workflow). This is a purpose-built financial execution tool (placing market/limit orders and managing orders), not a generic interface, so it provides direct financial execution authority.