SimpleFunctions

SimpleFunctions — AI-native prediction market runtime for Kalshi & Polymarket. Thesis tracking, edge scanning, position monitoring, and trade execution via C...

This skill appears to be a legitimate CLI wrapper for prediction-market trading, but the SKILL.md and registry metadata disagree: the runtime docs reference sensitive credentials (SF_API_KEY, KALSHI_API_KEY_ID, KALSHI_PRIVATE_KEY_PATH) and a Telegram bot token that are not listed in the registry. Before installing or providing credentials: 1) Verify the npm package @spfunctions/cli on npmjs.org (author, downloads, recent versions) and inspect its source code (or the GitHub repo) to ensure it doesn't exfiltrate keys. 2) Prefer least-privilege keys: use API keys with only read or simulated/trading scopes for testing, and avoid placing long-lived private keys on disk if possible. 3) Do not grant trading credentials until you confirm how the agent will obtain explicit confirmation before executing real trades (or run in manual mode). 4) Treat KALSHI_PRIVATE_KEY_PATH as highly sensitive — keep it in a protected location or use a dedicated key with limited permissions. 5) If you rely on Telegram alerts, consider using a bot account with limited exposure. 6) Ask the publisher to correct the registry metadata so required env vars and install steps are explicit. If you cannot validate the npm package source, run the CLI in an isolated environment or avoid supplying live trading credentials.

Type: OpenClaw Skill Name: simplefunctions Version: 0.1.0 The skill bundle describes a CLI tool for prediction market analysis and trading on Kalshi and Polymarket via the @spfunctions/cli npm package. All documented commands, such as market scanning, position monitoring, and trade execution, are consistent with the stated purpose, and the use of environment variables for API keys (e.g., KALSHI_PRIVATE_KEY_PATH) is standard for this type of financial utility. No evidence of malicious intent, data exfiltration, or prompt injection was found in SKILL.md or _meta.json.