Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent trading UI guide, but it includes real wallet connection and order-submission examples without clear safety boundaries for live trading.
Review this skill before installation if you plan to use its examples in a live trading app. Treat the order-entry and wallet snippets as capable of affecting real funds unless you explicitly configure a testnet or disabled-trading mode, and require user confirmation around any order placement or position-changing action.
The skill documents wallet connection and live order submission flows without an explicit warning that these components may initiate real trading or interact with a user's wallet. In a trading context, omission of such warnings can cause downstream agent or developer misuse, increasing the risk of unintended financial actions and unsafe integration into automated flows.
The manifest frames the skill as providing pre-built React components for trading interfaces, which suggests UI composition guidance. However, the documented code invokes onSubmit(params) to actually submit trading orders, and other sections show active wallet connect/disconnect flows, which are transactional behaviors rather than merely building UI components.
This section is documented as a Sheet/Drawer component example, but the inline UI intent implied by the Close Position button suggests an action that would close a trading position. In the code, the button has no handler and only renders text, so the presented intent contradicts the actual behavior.
