Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward market-data API helper, with expected third-party registration and API calls that are visible in the documentation and scripts.
Install only if you are comfortable registering with api.traderhc.com, sending an agent name and API requests to that service, and managing the returned API key. Avoid exposing the key in shared logs or shell history, and use a dedicated webhook URL if you enable alerts.
The skill is presented mainly as a market data interface, but its primary setup flow automatically registers the user/agent with a remote service and stores a returned credential in the environment. That behavior changes the trust and privacy model because it causes account creation and credential handling before the user is clearly warned about those side effects.
The skill is presented mainly as a market data interface, but its primary setup flow automatically registers the user/agent with a remote service and stores a returned credential in the environment. That behavior changes the trust and privacy model because it causes account creation and credential handling before the user is clearly warned about those side effects.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
fi
# Register
RESPONSE=$(curl -s -X POST "$BASE_URL/api/v1/register" \
-H "Content-Type: application/json" \
-d "{\"name\": \"$AGENT_NAME\"}")
This duplicate finding identifies the same risky behavior in the quick-start registration snippet: sending a request to an external API and ingesting the returned secret. In an agent-skill ecosystem, copy-pasteable shell commands can be operationalized quickly, so external transmission without strong warning or key-handling guidance is materially more dangerous than a plain hyperlink.
# Register (free, no KYC)
export API_KEY=$(curl -s -X POST "https://api.traderhc.com/api/v1/register" \
-H "Content-Type: application/json" \
-d '{"name": "MyAgent"}' | jq -r '.api_key')
This duplicate finding identifies the same risky behavior in the quick-start registration snippet: sending a request to an external API and ingesting the returned secret. In an agent-skill ecosystem, copy-pasteable shell commands can be operationalized quickly, so external transmission without strong warning or key-handling guidance is materially more dangerous than a plain hyperlink.
# Register (free, no KYC)
export API_KEY=$(curl -s -X POST "https://api.traderhc.com/api/v1/register" \
-H "Content-Type: application/json" \
-d '{"name": "MyAgent"}' | jq -r '.api_key')
This example sends an authenticated request to the external market-data API using the API key obtained earlier. While expected for an API client, it still represents outbound transmission to a third-party service and encourages users to expose a credential in a shell command context without discussion of rate limits, logging exposure, or secret-handling risks.
-d '{"name": "MyAgent"}' | jq -r '.api_key')
curl -s "https://api.traderhc.com/api/v1/data/overview"
-H "X-API-Key: $API_KEY" | jq '.data'
Without declared permissions the skill's intent is opaque and cannot be validated.
This URL appears in the active registration command, which performs an external POST and returns credentials. Because it initiates account creation and credential issuance, the context makes it more sensitive than a normal documentation link.
export AGENTHC_API_KEY=$(curl -s -X POST "https://api.traderhc.com/api/v1/register" \
-H "Content-Type: application/json" \
-d '{"name": "MyAgent"}' | jq -r '.api_key')
This URL appears in the active registration command, which performs an external POST and returns credentials. Because it initiates account creation and credential issuance, the context makes it more sensitive than a normal documentation link.
export AGENTHC_API_KEY=$(curl -s -X POST "https://api.traderhc.com/api/v1/register" \
-H "Content-Type: application/json" \
-d '{"name": "MyAgent"}' | jq -r '.api_key')
The setup command sends registration data (name) to a third-party API and immediately captures the returned API key into the environment without any privacy notice, data-use statement, or warning about external account creation. In agent contexts, this can cause unintended disclosure of agent identity metadata and silent enrollment with an external provider.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Query multiple endpoints in one request:
curl -s -X POST "https://api.traderhc.com/api/v1/data/batch" \
-H "X-API-Key: $AGENTHC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"endpoints": ["overview", "fixed_income", "macro"]}' | jq '.'
The webhook subscription example sends a callback URL to a third-party service without warning that this reveals integration endpoints and may expose internal deployment details. In operational environments, callback URLs can disclose infrastructure names, routing patterns, or publicly reachable webhooks that become attractive targets.
This endpoint reference is part of the active webhook-subscription operation, which shares a callback URL with a third party and can expose integration details. The context raises the risk above ordinary API usage because it establishes an external-to-internal communication path.
-H "X-API-Key: $AGENTHC_API_KEY" | jq '.alerts'
# Subscribe via webhook
curl -s -X POST "https://api.traderhc.com/api/v1/alerts/subscribe" \
-H "X-API-Key: $AGENTHC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"type": "market_events", "callback_url": "https://your-agent.com/webhook"}' | jq '.'
This endpoint reference is part of the active webhook-subscription operation, which shares a callback URL with a third party and can expose integration details. The context raises the risk above ordinary API usage because it establishes an external-to-internal communication path.
-H "X-API-Key: $AGENTHC_API_KEY" | jq '.alerts'
# Subscribe via webhook
curl -s -X POST "https://api.traderhc.com/api/v1/alerts/subscribe" \
-H "X-API-Key: $AGENTHC_API_KEY" \
-H "Content-Type: application/json" \
-d '{"type": "market_events", "callback_url": "https://your-agent.com/webhook"}' | jq '.'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if [ -z "${AGENTHC_API_KEY:-}" ]; then
echo "Error: AGENTHC_API_KEY not set" >&2
echo "Register: curl -s -X POST '$BASE_URL/api/v1/register' -H 'Content-Type: application/json' -d '{\"name\": \"MyAgent\"}'" >&2
exit 1
fi
The script performs an outbound POST to a third-party endpoint during setup, transmitting user or agent-supplied data off-host. In the context of an AI-agent skill, unexpected external transmission is more dangerous because setup may run unattended and users may assume it is only local configuration.
fi
# Register
RESPONSE=$(curl -s -X POST "$BASE_URL/api/v1/register" \
-H "Content-Type: application/json" \
-d "{\"name\": \"$AGENT_NAME\"}")
In --auto mode, the script silently sends agent-controlled registration data to a remote service without any interactive disclosure or consent prompt. In an agent setting, this can cause unintended external data transmission and account creation, especially when the caller may not realize setup performs a network side effect.
Auto mode prints the newly issued API key directly to stdout, which is commonly captured by logs, orchestration layers, agent transcripts, or shell history pipelines. This can expose a live credential to unintended readers and enable unauthorized API use.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "To make it permanent, add this line to your shell config (~/.zshrc or ~/.bashrc):"
echo " export AGENTHC_API_KEY=\"$API_KEY\""
echo ""
echo "Full docs: https://api.traderhc.com/docs"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "To make it permanent, add this line to your shell config (~/.zshrc or ~/.bashrc):"
echo " export AGENTHC_API_KEY=\"$API_KEY\""
echo ""
echo "Full docs: https://api.traderhc.com/docs"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "To make it permanent, add this line to your shell config (~/.zshrc or ~/.bashrc):"
echo " export AGENTHC_API_KEY=\"$API_KEY\""
echo ""
echo "Full docs: https://api.traderhc.com/docs"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "To make it permanent, add this line to your shell config (~/.zshrc or ~/.bashrc):"
echo " export AGENTHC_API_KEY=\"$API_KEY\""
echo ""
echo "Full docs: https://api.traderhc.com/docs"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "To make it permanent, add this line to your shell config (~/.zshrc or ~/.bashrc):"
echo " export AGENTHC_API_KEY=\"$API_KEY\""
echo ""
echo "Full docs: https://api.traderhc.com/docs"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "To make it permanent, add this line to your shell config (~/.zshrc or ~/.bashrc):"
echo " export AGENTHC_API_KEY=\"$API_KEY\""
echo ""
echo "Full docs: https://api.traderhc.com/docs"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "To make it permanent, add this line to your shell config (~/.zshrc or ~/.bashrc):"
echo " export AGENTHC_API_KEY=\"$API_KEY\""
echo ""
echo "Full docs: https://api.traderhc.com/docs"
No suspicious patterns detected.