Vynn Backtester

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone or anything using this configured key can run Vynn backtests under the user's account or quota.

Why it was flagged

The plugin uses a service API key to authenticate remote backtest requests. This is expected for the Vynn integration, but it is still credentialed access that can consume the user's Vynn quota.

Skill content

self.api_key = os.getenv("VYNN_API_KEY", "") ... "X-API-Key": self.api_key

Recommendation

Use a Vynn-specific API key, keep it out of shared logs or prompts, and verify any VYNN_BASE_URL override before running the skill.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

Proprietary strategy ideas, ticker lists, or lookback choices may leave the local environment and be processed by Vynn.

Why it was flagged

The skill discloses that backtest inputs are transmitted to an external provider. This is purpose-aligned, but users should notice the data flow.

Skill content

Strategy descriptions and ticker lists are sent to the Vynn API for backtest execution

Recommendation

Only submit strategy details you are comfortable sharing with Vynn, and avoid including personal portfolio holdings or sensitive account information in strategy text.