Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward stock-watchlist helper with disclosed read and add/remove watchlist actions, but users should understand that add and remove commands can change a saved watchlist.
Install only if you want an agent to help view and manage an AlphaGBM-style ticker watchlist. Treat add and remove commands as changes to a saved watchlist, and confirm ticker removals if the agent does not already ask.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
GET /api/user/watchlist
POST /api/user/watchlist
DELETE /api/user/watchlist/{symbol}
GET /api/user/watchlist/alerts
GET /api/analytics/hot-options
The trigger list includes broad natural-language phrases like 'my watchlist', 'hot options', and 'daily watchlist' without clear scoping or confirmation requirements. In an agent environment, overly generic triggers increase the chance of accidental invocation or invocation from unrelated user context, which can lead to unintended data access or state-changing watchlist operations.
The skill describes watchlist management features and API usage but does not clearly warn users that some commands persistently modify stored account data through POST and DELETE operations. Without explicit disclosure, users may believe they are performing a temporary query when they are actually changing their saved watchlist, creating a consent and integrity risk.
No suspicious patterns detected.