Trading Assistant Core

Market data analysis toolkit with technical indicators and portfolio tracking. Educational use only.

Security Scan

The skill's code, required binaries, and environment variables are consistent with a market-data/analysis tool that uses Twelve Data and Alpha Vantage API keys; nothing obvious indicates mismatched credentials, shell execution, or hidden exfiltration in the files provided, but some source files were truncated/omitted so a final check of the remaining modules and requirements is recommended.

Purpose & Capability

Name/description (market data, indicators, portfolio tracking) align with what is requested: python/pip and API keys for Twelve Data and Alpha Vantage. Primary credential (TWELVE_DATA_API_KEY) is appropriate. Required binaries and declared env vars are directly relevant to the stated functionality.

Instruction Scope

SKILL.md instructs the agent to install dependencies, export the two API keys, and run the Python scripts. The files shown perform read-only data fetches (urllib/requests), indicator calculations, portfolio bookkeeping (local JSON files), and logging. SKILL.md's claim of 'no subprocess, no shell, no eval/exec' appears accurate in the reviewed files. The agent is instructed only to use the declared API keys and local files; there is no broad or vague permissioning in the instructions.

Install Mechanism

No external binary download/install spec in the registry entry. The repository contains Python modules and a requirements.txt; installation is via pip -r requirements.txt as documented in SKILL.md. This is a common, low-risk install mechanism — but you should review requirements.txt before installing to ensure there are no unexpected third-party packages.

Credentials

Only two API keys are required (TWELVE_DATA_API_KEY, ALPHA_VANTAGE_API_KEY), which match the data sources referenced in code and README. The code reads TRADING_ASSISTANT_LANG optionally (i18n), and the modules read/write local JSON files for persistence — no unrelated secrets or cloud credentials are requested. No evidence that environment variables beyond those declared are accessed in the inspected files.

Persistence & Privilege

The skill does create and write local files/directories (data/, logs/, portfolio/holdings.json, accuracy_log.json). always:false and normal model invocation settings (autonomy allowed) are used. Writing local JSON logs/config is expected for this app, but you should be aware it will persist portfolio/accuracy data in the skill's directory. There is no indication it modifies other skills or system-wide agent config.

Assessment

This package appears internally consistent for an educational trading-analysis tool, but before installing or running it: 1) Inspect requirements.txt and the remaining (omitted) Python files (trading_signals.py, support_resistance.py, any notification modules) for network calls, webhooks, or hardcoded remote endpoints (Feishu/DingTalk/email integrations are mentioned in README). 2) Run it in an isolated environment/container and only provide the minimal API keys needed (rotate keys after testing if concerned). 3) Be aware the tool will create/write local files (data/, logs/, portfolio/holdings.json, accuracy_log.json); if you have sensitive data in your environment, avoid mounting sensitive directories. 4) Do not supply brokerage credentials — this skill claims 'no trade execution' and there is no declared brokerage credential requirement; supplying broker keys would be unnecessary and risky. 5) If you plan to trust outputs for real trading, validate indicator logic and test thoroughly; the repository is labelled educational and 'not financial advice.' Finally, if you want higher assurance, provide the omitted source files (or examine them yourself) so they can be checked for any outbound notification code or unexpected behavior — I rated confidence medium because a few files were truncated/omitted in the listing.

Market Data Analysis Toolkit

Educational tool for learning technical analysis and portfolio tracking.

What It Does

• Calculate technical indicators (RSI, MACD, Bollinger Bands)
• Track portfolio holdings and P&L
• Generate price alerts
• Analyze historical data

Installation

pip install -r requirements.txt
export TWELVE_DATA_API_KEY=your_key
export ALPHA_VANTAGE_API_KEY=your_key
python3 trading_signals.py

Security

• Pure Python code
• No subprocess or shell calls
• No eval/exec
• Environment variables for API keys
• Read-only API access

Links

• GitHub: https://github.com/XuXuClassMate/trading-assistant
• Issues: https://github.com/XuXuClassMate/trading-assistant/issues
• Docker Hub: https://hub.docker.com/r/xuxuclassmate/trading-assistant

License

MIT License - Educational use only, not financial advice.