Security audit
Security checks for vulnerabilities and agentic risk
This is a methodology-only investment skill with no code execution, but it gives actionable trading and tax guidance without clear financial-risk disclaimers or human-approval guardrails.
Install only if you want a structured investment-analysis playbook. Treat its outputs as educational research support, not personalized financial, legal, or tax advice; verify data independently and require explicit human approval before making trades, changing allocations, or acting on tax-harvesting suggestions.
The skill markets portfolio construction, risk management, and trade execution guidance without clear warnings that outputs may influence real financial decisions. In an agent setting, this increases the chance that users treat generated content as actionable investment advice, potentially leading to harmful trades or unintended execution behavior without adequate human review.
The skill gives highly actionable investment, trading, tax, and portfolio-management instructions, including position sizing, stop-losses, allocation models, and execution checklists, but does not warn users that this is generalized educational content rather than personalized financial, investment, or tax advice. That omission increases the risk that users will treat the output as professional advice and make consequential financial decisions without appropriate suitability, jurisdiction, or fiduciary review.
The documentation makes a strong claim that the skill is pure methodology with no external dependencies or scripts. However, the README also presents the skill as an installable package and links to external resources, which makes the 'zero dependencies' claim misleading as written, even if the core functionality may still be methodology-only.
The README presents example invocations like "Analyze BTC" and "Portfolio health check" as triggers, but it does not define whether these are exact phrases, examples only, or what constraints limit activation. In a markdown skill description, this lack of trigger specificity can cause unintended invocation during ordinary finance-related conversation.
No suspicious patterns detected.
