Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed market-analysis helper that fetches public Binance data and optionally reads local fill logs, without trading, persistence, or credential use.
Install only if you are comfortable with a trading-analysis skill that uses live Binance market-data requests and may read local paperbot fill logs. It does not place trades or use credentials, but financial strategy outputs should be independently checked before acting on them.
The CLI help text is presented in Korean, which imposes a specific language on users without offering a choice. The file also includes additional Korean user-facing output elsewhere, indicating a locale-specific UX that is not documented as region-specific or optional.
The script prints operational notices such as missing-file and no-data messages in Korean only. For a general-purpose script, this is a language-policy issue unless the Korean-only constraint is explicitly documented and justified.
The main results banner includes Korean text and does not provide any locale selection. This forces a specific language in normal operation without user consent or documentation that the tool is region-specific.
The argument help string is written only in Korean ("분석할 심볼"), which imposes a specific language in user-facing text without offering an alternative or opt-in. This matches the language/locale policy concern for natural-language content embedded in code.
The command-line help string is written only in Korean ("분석할 심볼 (예: ETHUSDT)"), which imposes a specific language on users without any opt-in or alternative. The policy specifically calls for flagging language or locale constraints when the skill does not offer a language choice or clearly justify the restriction.
The script performs HTTP requests in fetch_json, which is then used to query Binance market endpoints. While this is not inherently dangerous, there is no docstring, comment, or user-facing notice near the network operation explaining that the script will contact an external service.
No suspicious patterns detected.
