Security audit
Security checks for vulnerabilities and agentic risk
This skill is clearly for Groww stock trading, but it gives an agent live order-placement and cancellation paths without documented confirmation safeguards.
Install only if you intend to let an agent access your Groww account and potentially place or cancel trades. Use a restricted key if Groww supports it, keep trading disabled unless needed, and require explicit human confirmation for every buy, sell, or cancel request.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
openclaw configure
The skill documents direct order placement and cancellation flows, including market orders, without requiring explicit user confirmation, order-parameter verification, or any warning about irreversible financial consequences. In an agent setting, this increases the chance of unintended or prompt-induced trades, making the skill materially riskier than a read-only market-data integration.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.groww.in/v1/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.groww.in/v1/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.groww.in/v1/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.groww.in/v1/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.groww.in/v1/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.groww.in/v1/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
https://api.groww.in/v1/
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Portfolio/Holdings:
curl -H "Authorization: Bearer $GROWW_API_KEY" -H "Accept: application/json" \
"https://api.groww.in/v1/holdings/user"
Unlike the read-only endpoints, this external transmission creates a live trade using an authenticated brokerage token. In the context of an autonomous or semi-autonomous agent, documenting a direct order-creation call without enforced confirmation or guardrails materially raises the risk of unauthorized or accidental financial transactions.
curl -X POST -H "Authorization: Bearer $GROWW_API_KEY"
-H "Accept: application/json" -H "Content-Type: application/json"
-d '{"trading_symbol":"TATAMOTORS","quantity":10,"validity":"DAY","exchange":"NSE","segment":"CASH","product":"CNC","order_type":"MARKET","transaction_type":"BUY"}'
"https://api.groww.in/v1/order/create"
**Order Status:**
This authenticated external transmission cancels an order, which is a state-changing account action with possible financial consequences. In an agent skill, presenting a direct cancellation call without mandatory confirmation or anti-abuse controls can lead to unauthorized disruption of user trading activity.
curl -X POST -H "Authorization: Bearer $GROWW_API_KEY"
-H "Accept: application/json" -H "Content-Type: application/json"
-d '{"segment":"CASH","groww_order_id":"ABC123"}'
"https://api.groww.in/v1/order/cancel"
## Stock Symbols
No suspicious patterns detected.