Kalshi Weather Trader

The skill's code, SKILL.md, and clawhub.json consistently describe a Simmer/DFlow-on-Solana weather trading bot and require SIMMER_API_KEY and SOLANA_PRIVATE_KEY — both are proportionate for live trading. One inconsistency: the top-level 'Requirements' block in the supplied registry summary said 'Required env vars: none', but clawhub.json and the SKILL.md explicitly require those two credentials. This appears to be a metadata omission, not a functional mismatch.

The runtime instructions stay within trading scope (fetch Simmer markets, NOAA forecasts, sign trades with the Solana key). They instruct the agent to ask the user for SIMMER_API_KEY and SOLANA_PRIVATE_KEY and to store them in environment variables. Storing a private key in an env var is sensitive — the instructions do not offer safer alternatives (hardware wallet, signing service). The code also optionally calls a trade-journal hook (log_trade) if a tradejournal package is present, which could send trade data externally depending on that package.

There is no install spec in the skill bundle (instruction-only install), but clawhub.json declares a pip dependency on 'simmer-sdk'. That dependency is expected for the stated purpose. Because there's no automated install step included, the consumer or platform will need to install simmer-sdk themselves; verify the package origin and contents before installing into an environment that holds secrets or funds.

The skill requires SIMMER_API_KEY and SOLANA_PRIVATE_KEY which are necessary for trading. However, asking users to place their Solana private key directly into environment variables is high-risk (env vars can leak via logs, process lists, backups, or misconfigured host). No unrelated credentials are requested. Also note the skill may read other environment variables (TRADING_VENUE, AUTOMATON_MAX) and writes/loads config via simmer_sdk.skill (which may persist settings to disk).

The skill is not always-enabled and does not request elevated platform privileges. It is marked autostart: false in the metadata. The automaton entrypoint is the skill script itself, which is expected. No changes to other skills' configs are observed.