Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly a disclosed simulated stock-trading helper, but its cancel and trade flows can change account state directly, including canceling all open orders from broad wording without confirmation.
Install only if you intend to connect a 妙想 simulated trading account. Keep MX_APIKEY secret, leave MX_API_URL pointed at the legitimate provider endpoint, avoid vague buy/sell/cancel wording, and treat the output directory as sensitive because it stores raw account results. Be especially careful with cancel requests, since this version can cancel all open simulated orders from broad cancel wording.
}
try:
response = requests.post(url, headers=headers, json=payload, timeout=30)
response.raise_for_status()
return response.json()
except requests.exceptions.RequestException as e:65/65 vendors flagged this skill as clean.
No suspicious patterns detected.