Security audit
Security checks for vulnerabilities and agentic risk
This WT8 trading helper is coherent and not deceptive, but it needs Review because it gives ready-to-use live trading and order-execution guidance without clear confirmation gates or prominent real-money risk warnings.
Review carefully before installing or using this with any live brokerage or WT8 production environment. Treat generated strategies as educational drafts, verify whether they will run in simulation or live mode, require explicit human approval before any order-capable deployment, and validate symbols, sizing, slippage, liquidity, drawdown limits, and stop behavior with backtesting or paper trading first.
The document title and all instructional content are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope.
This markdown file describes '自动下单', '实盘运行', and trading command usage, but does not include a warning about the risks of executing trades, account impact, or the need for user confirmation before live actions. For markdown files, omissions of warnings about behaviors affecting user data, privacy, or system integrity should be flagged; financial account-impacting actions are safety-critical in this context.
The file provides concrete automated trading signals for opening and closing long/short positions, and later includes stop-loss execution logic, but it does not include any warning that the example could be adapted to live trading or cause financial loss if used directly. In the context of a trading skill, this increases the chance that a user treats sample code as production-safe and executes orders without understanding market, slippage, leverage, or testing risks.
The file provides executable trading strategy examples that automatically open, add to, reduce, and close positions, but it does not include any visible warning that the examples may trigger live orders or cause financial loss if used in a real trading environment. In a trading skill context, omission of risk, simulation-only, and capital-loss warnings materially increases the chance that users copy these examples into production without understanding order execution consequences.
The comments and surrounding text describe a cross-contract arbitrage strategy using rebar versus hot-rolled coil pricing, but the implementation never imports or references the hot-rolled coil contract and instead trades solely on the local instrument's moving averages. This mismatch is dangerous because users may deploy the strategy believing it is hedged or spread-based when it actually takes outright directional exposure, materially changing risk, margin, and behavior.
This markdown file provides executable trading strategy examples that automatically place orders, adjust position sizes after losses, and trigger liquidation based on drawdown thresholds. The description contains no explicit warning that these examples can affect real positions, cause financial loss, or should be tested in a safe/simulated environment first.
This file provides ready-to-use automated stop-loss and take-profit trading logic, including equity drawdown liquidation examples, but contains no warning that the snippets can affect live positions and real money if used in production. In a trading-skill context, omission of risk disclosures and safe-use guidance can lead users to deploy examples directly without testing, increasing the chance of unintended losses or account-wide liquidation behavior.
The documentation explicitly instructs users to place trades before a candle closes and discusses order execution behavior, but it does not warn that this can trigger real live orders based on transient intra-candle conditions. In a trading-automation context, missing warnings about irreversible execution, false signals, and financial loss materially increases the chance that users deploy risky behavior without understanding the consequences.
The guidance recommends market-price stop-loss execution to ensure fills, but omits the corresponding risk that market orders can execute immediately at significantly worse prices due to slippage or illiquidity. In an automated trading skill, that omission can cause users to underestimate loss magnitude and deploy unsafe execution settings in live markets.
This document provides concrete trading instructions and executable strategy examples for opening and closing positions (e.g. BK, SK, SP, BP, AUTOFILTER) without any warning that these are financial trading actions involving risk of loss. In an agent skill context, such examples can be interpreted as actionable recommendations or copied directly into automated trading workflows, increasing the chance of unsafe financial decisions by users.
The file provides concrete trading strategy examples, position sizing, and stop-loss/order instructions that could plausibly be used in live or simulated trading, but it does not include any warning about financial risk, leverage, drawdown, or unintended live-order execution. In the context of an agent skill, this omission increases the chance that users treat the examples as safe defaults and deploy them without understanding loss exposure.
This document gives concrete automated trading signal and order instructions, including opening, closing, reversing, and scaling positions, but does not include any warning about real-money execution, market risk, slippage, or the consequences of deploying the logic live. In an agent-skill context, that omission is safety-relevant because users may treat the examples as production-ready guidance and connect them to systems capable of placing live orders.
The phraseology around a 'universal' strategy-writing formula overstates general applicability and lacks caution that different markets, instruments, liquidity conditions, and execution environments behave differently. This can mislead users into overconfidence and unsafe deployment of simplistic strategies in live trading contexts.
The document gives concrete trading instructions for opening positions, closing positions, and stop-loss behavior, but it does not include any warning that trading can cause financial loss or that examples are educational rather than suitable for live deployment. In a strategy-authoring skill, this omission can encourage inexperienced users to apply the examples directly in real markets with insufficient risk awareness.
The README explicitly promotes account queries, order placement, simulated running, and backtesting, but it does not warn users that generated output may translate into real trading actions with financial loss risk. In a trading skill, omission of a clear real-trade risk disclaimer increases the chance that users or downstream agents treat generated instructions as safe to execute in live environments.
The classification table includes direct live-trading triggers such as 买开、卖开、买平、卖平, which can steer the assistant toward executable order-generation behavior, yet the README gives no warning that these requests may produce instructions suitable for real trades. In this context, the skill is more dangerous because it is positioned as a quick-start assistant for WT8 trading workflows, making accidental live-use plausible.
The title and all instructional content are written exclusively in Chinese, with no indication that other languages are supported or that the user can opt into this locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy concern.
The prompt explicitly instructs the agent on order-placement and automated trading behavior, including real execution semantics, but does not include any safety warning, confirmation requirement, or restriction against live trading. In a financial trading assistant, omission of clear risk disclosures and safeguards can lead users to run generated strategies or commands that directly affect funds and positions without appreciating the consequences.
The template explicitly encourages live and production trading use ('实盘运行', '实盘生产') and provides operational guidance for deploying strategies, but it does not include a clear risk warning that these are educational examples, not financial advice, and may cause real monetary loss if used directly. In the context of an agent skill that can help users generate or adapt trading logic, omission of such warnings materially increases the chance of unsafe real-world use.
The skill explicitly supports strategy writing, backtesting, execution, and position/risk management for a live trading platform, but it provides no warning that generated outputs may be used to place real orders or alter financial exposure. In this context, users may over-trust model code or operational instructions and deploy them directly, creating foreseeable financial loss from unsafe or misunderstood trading logic.
The skill explicitly advertises backtesting, order placement, and trading execution capabilities, but provides no warnings, approval gates, or constraints around financially impactful actions. In a trading context, this increases the risk that an agent could assist with or automate real transactions without clearly signaling risk, verification requirements, or the difference between simulation and live execution.
This markdown file is entirely written in Chinese and does not indicate that language selection is optional or that the skill is specifically limited to a Chinese-speaking or China-region audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation.
The natural-language instructional content appears to require Chinese comprehension throughout the file, with no indication that language selection is optional or user-configurable. Under the language/locale policy check, forcing a specific language without user opt-in can be a policy concern when no justification is provided.
All headings, comments, and instructional text in the skill file are presented only in Chinese, with no indication that the skill is region-specific or that users may select another language. Under the stated policy, a fixed language choice without opt-in can be a natural-language locale violation.
This markdown file instructs users to perform parameter optimization, sensitivity testing, and evaluate strategy capability, but it does not include any caution about overfitting, simulated-results limitations, or the fact that backtests can materially affect trading decisions. Because the file is a markdown skill description and discusses behavior that could affect user finances, a user-facing warning would improve safety disclosure.
No suspicious patterns detected.
