Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for paid live market-data API calls, with costs and payment controls disclosed.
Install only if you are comfortable with an agent making live API requests and, after your approval, spending small USDC amounts through your own x402 wallet/client. Review the live price before each paid call, keep per-call limits tight, and treat the returned market data as informational rather than trading advice.
The file states the skill 'covers its liquidation and funding routes' and describes only liquidation/funding-focused scope, yet later includes options, market-state, macro-calendar, equity-24h, and MCP endpoints as part of the skill guidance. That broadens the effective behavior beyond the manifest's stated purpose of liquidation, funding radar, and options.
Early documentation narrows intent to liquidation and funding routes, but later sections document options-summary, options-gex, market-state, tradfi-radar, and even additional macro/equity routes. This is an active contradiction in the file's own description of what the skill covers.
The prose says the skill 'runs no code of its own,' but the manifest requires external binaries (curl, base64) and the file instructs the agent to execute HTTP/payment command flows. While this may be intended as usage guidance, it contradicts the claim that the skill has no operational code path.
No suspicious patterns detected.
