Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small external market-signal client that discloses premium payment behavior and does not show hidden persistence, credential access, or destructive actions.
Before installing, understand that using this skill can contact an external API with the ticker you provide and may return a premium payment request. Do not treat the returned market signals as verified financial advice, and only follow payment instructions if you trust the provider.
The skill advertises executable usage and implies external service access, but it does not declare any explicit tool scope or permissions for network use. This creates an authorization and transparency gap: hosts or users may not understand that the skill can initiate external communication, increasing the risk of unintended data exposure or policy bypass.
The skill text states that it connects to an external service and that premium signals require a 402 payment proof, but it does not clearly warn users in the description or usage contract about network interaction and potential paid behavior. This is dangerous because users or orchestrators may invoke it without informed consent, leading to unexpected outbound requests, billing-related flows, or trust in unverified financial signal sources.
This manifest file contains only a general description of the skill as 'Automated wave counting and market cycle prediction' without any specificity about when the skill should be invoked or what user requests should trigger it. In manifest files, missing trigger scope or constraints can lead to ambiguous activation behavior if the description is used for routing or discovery.
No suspicious patterns detected.
