Security audit
Security checks for vulnerabilities and agentic risk
This skill mostly analyzes crypto portfolios, but it also includes under-disclosed trading alert code and strategy examples that go beyond safe portfolio tracking.
Review this before installing if you want a purely safe portfolio tracker. The core Python analyzer is mostly read-only and purpose-aligned, but the package also contains trading-signal code, aggressive strategy examples, and automation/sharing examples that may expose sensitive portfolio information or encourage speculative decisions. Keep holdings and cost-basis files private, avoid posting detailed reports to shared channels, and do not treat generated market signals as financial advice.
### 3. Set Up Configuration
For advanced features like cost basis tracking, create `portfolio-config.json`:
```json
{## Configuration File Format
Create a `portfolio-config.json` file with your portfolio settings:
```json
{async function getMarketData() {
const ids = CONFIG.watchlist.map(c => COINGECKO_IDS[c]).filter(Boolean).join(',');
const url = `https://api.coingecko.com/api/v3/coins/markets?vs_currency=usd&ids=${ids}&order=market_cap_desc&per_page=50&sparkline=false&price_change_percentage=1h,24h,7d`;
const data = await httpsGet(url);
if (!data || !Array.isArray(data)) return [];
return data;async function getMarketData() {
const ids = CONFIG.watchlist.map(c => COINGECKO_IDS[c]).filter(Boolean).join(',');
const url = `https://api.coingecko.com/api/v3/coins/markets?vs_currency=usd&ids=${ids}&order=market_cap_desc&per_page=50&sparkline=false&price_change_percentage=1h,24h,7d`;
const data = await httpsGet(url);
if (!data || !Array.isArray(data)) return [];
return data;// ─── Fear & Greed ──────────────────────────────────────────
async function getFearGreed() {
const data = await httpsGet('https://api.alternative.me/fng/?limit=1');
if (!data || !data.data || !data.data[0]) return null;
const fg = data.data[0];
const v = parseInt(fg.value);// ─── Coinbase BTC Price (backup) ───────────────────────────
async function getCoinbasePrice(pair = 'BTC-USD') {
const data = await httpsGet(`https://api.coinbase.com/v2/prices/${pair}/spot`);
if (!data || !data.data) return null;
return parseFloat(data.data.amount);
}No suspicious patterns detected.