Security audit
Security checks across malware telemetry and agentic risk
This trading-analysis skill is not clearly malicious, but it automatically installs and updates external code and stores an optional API key in local files, which users should review before installing.
Install only if you are comfortable with the skill cloning and updating external GitHub repositories, installing Python packages, using local MT5/TradingView data access, and keeping a TradingView key in ~/.tlc/.env. Prefer entering secrets directly into the local file rather than chat, review the upstream repositories and setup script first, and remove the ~/.tlc configuration if you no longer want the persistent state.
subtler form of fabricating data. ## 0b. First-run setup (auto-configure — runs ONLY when config is missing) Still inside `$TLC_HOME`, check for config: `ls .env config.yaml 2>/dev/null`. - **Both present → already configured. Continue to §1, and do NOT re-prompt for anything** (including a TV key): if TradingView is enabled but `.env` has no `TVR_API_KEY`, say so **once**, only the first time a TV symbol is actually
into this call. Re-assert `cd "$TLC_HOME"` + the PATH export in `terminal` and retry there. **Never** let such an error override data you already fetched successfully earlier in the same conversation — reuse that data, don't discard it. - **Read and write this skill's files in `terminal` too** — temp `frames.json`/ `packet.json`/`ballot.json`, spec files, `config.yaml`/`.env`. Every path here is relative to `$TLC_HOME`; if you use any other tool for a file, give it the **absolute** path under `$TLC_HOME`, or the next terminal command won't find it.
VirusTotal findings are pending for this skill version.
No suspicious patterns detected.
