IBKR Trading

Key points to consider before installing: - Metadata mismatch: The registry claims no env/credentials required, but the code and instructions require your IBKR username/password, account ID, and local binaries (Java, Chrome, chromedriver, Xvfb). Treat this omission as a red flag and expect to manually provide sensitive credentials. - Secrets handling: The setup creates a plaintext .env file containing IBEAM_ACCOUNT and IBEAM_PASSWORD. If you proceed, store credentials securely (tighten file permissions), consider using a secrets manager, and avoid reusing credentials elsewhere. - Automated 2FA: The scripts automate login via IBeam and will prompt your phone for IBKR Key approval. The keepalive/re-auth automation can launch repeated auth attempts — ensure you want phone prompts produced automatically and monitor for unexpected activity. - TLS and network: The skill disables certificate verification (verify=False / curl -k) because the gateway uses a self-signed cert. This is common for localhost gateways but increases risk if your system or network is compromised. Prefer configuring a trusted cert if possible and avoid exposing the gateway to untrusted networks. - Verify sources: The download URL appears to be IBKR's official domain, and pip packages are used for ibeam — nevertheless verify the ibeam package source/version (pip info, project homepage) and validate the clientportal archive (checksum/signature) from IBKR if available. - Run in isolation: Run this in a dedicated, least-privileged user/account or VM/container to limit blast radius. Do not run as root. Review scripts (they are included) and test in paper account mode first. - If you need the skill: ask the publisher to correct the manifest to declare required env vars/primary credential and to document security implications. If you cannot verify or trust the skill owner, prefer implementing authentication and automation yourself or use an official IBKR integration.