Security audit
Security checks for vulnerabilities and agentic risk
This skill is a trading helper whose actions match its purpose, but it should be reviewed because it includes live trading operations without clear safety guardrails.
Review this skill carefully before installing if it will be used with real Orderly credentials. Prefer sandbox or paper trading first, restrict API permissions where possible, and require explicit user confirmation before closing positions, changing leverage, placing TP/SL orders, stop orders, or canceling orders.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
// Cancel single algo order
DELETE /v1/algo/order?order_id={order_id}&symbol={symbol}
// Cancel all algo orders for symbol
DELETE /v1/algo/orders?symbol={symbol}
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /v1/algo/order?order_id={order_id}&symbol={symbol}
// Cancel all algo orders for symbol
DELETE /v1/algo/orders?symbol={symbol}
// React SDK
const [algoOrders, { cancelAlgoOrder }] = useAlgoOrderStream();
The skill gives concrete instructions and code for partially or fully closing positions through live trading endpoints, but it does not explicitly warn that these actions execute real trades and can irreversibly reduce or eliminate an open position. In a trading skill, omission of such warnings increases the chance that an agent or user will treat the examples as safe read-only operations and trigger financially harmful actions.
The leverage management section shows how to change leverage directly, but it lacks an explicit warning that increasing leverage materially raises liquidation risk and changes account-wide margin requirements. Because leverage changes can quickly make positions unsafe, presenting the action as a simple UI control without guardrails is dangerous in this financial context.
The TP/SL and algo-order sections provide direct order-placement examples against live endpoints but do not clearly state that these create active market-affecting orders tied to open positions. In practice, misconfigured trigger prices, sides, or quantities can unintentionally close positions, leave positions unprotected, or create unexpected execution behavior.
No suspicious patterns detected.