Security checks across malware telemetry and agentic risk
This is a disclosed crypto trading skill, but it can make or cancel live financial orders through broad agent-triggered commands without an enforceable confirmation gate in the runtime code.
Review carefully before installing. Keep CRYPTO_DEMO=true unless you intentionally want live trading, use exchange API keys with withdrawal permissions disabled, start only small strategies after an explicit confirmation, and be aware that emergency-stop can cancel all open orders across configured exchanges.
def _save_state(self) -> None:
_STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
with open(_STATE_PATH, "w", encoding="utf-8") as fh:
json.dump(self._state, fh, indent=2, default=str)
# ------------------------------------------------------------------@staticmethod
def _write_pid() -> None:
_PID_PATH.parent.mkdir(parents=True, exist_ok=True)
with open(_PID_PATH, "w") as fh:
fh.write(str(os.getpid()))
@staticmethodtry:
import requests
payload = {"content": message}
resp = requests.post(webhook_url, json=payload, timeout=10)
if resp.status_code in (200, 204):
return True
logger.error("Discord webhook error: %d %s", resp.status_code, resp.text)def _save_state(self) -> None:
_STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
with open(_STATE_PATH, "w", encoding="utf-8") as fh:
json.dump(self._state, fh, indent=2, default=str)
def _reset_daily_if_needed(self) -> None:"updated_at": datetime.now(timezone.utc).isoformat(),
}
_STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
with open(_STATE_PATH, "w", encoding="utf-8") as fh:
json.dump(state, fh, indent=2, default=str)64/64 vendors flagged this skill as clean.