Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward financial alert helper, with disclosed alert creation, editing, listing, and deletion behavior.
Before installing, understand that this skill can help create, modify, and delete persistent market alerts. Use explicit ticker and alert identifiers, and confirm any delete or edit action before allowing it to proceed.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
GET /api/user/alerts POST /api/user/alerts PUT /api/user/alerts/{alert_id} DELETE /api/user/alerts/{alert_id} GET /api/user/alerts/triggered
The trigger list includes broad, generic phrases such as "set price alert," "VRP alert," and "delete alert" that can collide with ordinary user requests and cause the skill to activate outside clearly scoped financial-alert intent. In a skill that can create, modify, and delete persistent alerts, overbroad invocation increases the chance of unintended state-changing actions or routing the user into the wrong skill flow.