Security audit
Security checks for vulnerabilities and agentic risk
This skill is a crypto trading signal prompt that can produce actionable trade entries without clear risk warnings or tight activation controls.
Install only if you want an agent to generate crypto trade ideas, and treat outputs as informational rather than financial advice. Do not connect this skill to automated trading or account actions without a separate confirmation gate, risk disclosure, and a stricter output schema.
The manifest promises a binary decision interface ('only EXECUTE or NO TRADE'), but the body defines richer outputs including trade direction, levels, and rationale. This inconsistency is dangerous because downstream agents, wrappers, or users may rely on the safer manifest summary while the actual skill can emit actionable trading instructions that trigger financial actions.
The trigger keywords are broad terms like 'crypto', 'trading', 'BTC', 'ETH', and 'market analysis', which are common in ordinary conversation. In a high-impact financial skill, this increases the chance of unintended activation, causing the agent to produce trading recommendations in contexts where the user only wanted general discussion or education.
This skill is explicitly designed to recommend real trades in financial assets, yet it lacks a clear warning that outputs may influence investment decisions and lead to monetary loss. In the context of crypto trading, omission of risk disclosures and user-safety framing makes accidental or over-trusted use more dangerous, especially when the skill presents itself as 'professional-grade' and 'non-negotiable.'
The document first states 'Only EXECUTE or NO TRADE format. No additional commentary' but later requires detailed fields such as entry, stop, take-profits, expected R, and reasons. This ambiguity can cause unsafe parser behavior, policy bypasses, or accidental execution paths if one component expects a minimal token while another accepts detailed instructions.
