Security audit
Security checks for vulnerabilities and agentic risk
This is a paper-trading instruction skill with disclosed local portfolio and ledger state, and it does not include executable code, credential handling, or real-trading commands.
Before installing, treat this as a simulation framework: confirm where PORTFOLIO.json, LEDGER.csv, and lessons.md will be written, use explicit paper-trading-only prompts, and require confirmation before any large watchlist or autonomous run.
The skill advertises persistent components such as PORTFOLIO.json, LEDGER.csv, and lessons.md, but does not clearly warn users that invoking the skill may modify local files over time. This can surprise users, create unintended statefulness, and in an autonomous-agent context allow repeated writes that alter records, consume storage, or interfere with other workflows relying on those files.
The invocation examples are overly broad and action-oriented, including phrases like trading all signals, without defining approval boundaries, simulation-only constraints, or exclusions. In an agent setting, ambiguous triggers can cause the skill to be invoked in situations the user did not clearly intend, leading to autonomous high-frequency actions and downstream file/state changes.
No suspicious patterns detected.
