pp-kalshi

Warn

Audited by Snyk on May 8, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill wraps a Kalshi trading CLI with explicit, purpose-built market and account write operations. The Command Reference exposes endpoints to submit and amend orders (portfolio create-order, create-order-v2, batch-create-orders, amend-order, decrease-order, cancel-order, etc.), manage funds/subaccounts (apply-subaccount-transfer, get-subaccount-balances, update-subaccount-netting), and other trade-execution primitives. Auth guidance describes read/write API key tiers and how the CLI signs requests; an --agent mode and --yes/--dry-run flags make non-interactive execution possible. These are not generic I/O tools — they are specific mechanisms to place/cancel/modify market orders and move funds, i.e., direct financial execution.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
May 8, 2026, 05:35 PM
Issues
1