Security audit
Security checks across malware telemetry and agentic risk
This appears to be a legitimate stock and crypto analysis skill, but its optional social scanning handles live X/Twitter session cookies and exposes broad local environment secrets to an external CLI.
Review carefully before installing. The safest path is to use stock analysis, portfolio, watchlist, and hot scanning with --no-social, and avoid providing X/Twitter session cookies unless you understand that AUTH_TOKEN and CT0 can act like account access. Do not put unrelated secrets in the skill .env file, restrict file permissions, use a dedicated low-risk X account if social scanning is needed, and treat BUY/HOLD/SELL output as informational rather than trading advice.
for category, query in searches:
try:
env = os.environ.copy()
result = subprocess.run(
[bird_bin, "search", query, "-n", "15", "--json"],
capture_output=True, text=True, timeout=30, env=env
)for category, query in searches:
try:
env = os.environ.copy()
result = subprocess.run(
[bird_bin, "search", query, "-n", "15", "--json"],
capture_output=True, text=True, timeout=30, env=envfor query in queries[:4]: # Limit to avoid rate limits
try:
cmd = [BIRD_CLI, 'search', query, '-n', '10', '--json']
env = os.environ.copy()
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)for query in queries[:3]:
try:
cmd = [BIRD_CLI, 'search', query, '-n', '15', '--json']
env = os.environ.copy()
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)for category, query in searches:
try:
env = os.environ.copy()
result = subprocess.run(
[bird_bin, "search", query, "-n", "15", "--json"],
capture_output=True, text=True, timeout=30, env=env
)cmd = [BIRD_CLI, 'search', query, '-n', '10', '--json']
env = os.environ.copy()
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)
if result.returncode == 0 and result.stdout:
try:cmd = [BIRD_CLI, 'search', query, '-n', '15', '--json']
env = os.environ.copy()
result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)
if result.returncode == 0 and result.stdout:
try:from collections import defaultdict
from concurrent.futures import ThreadPoolExecutor, as_completed
# Load .env file if exists
ENV_FILE = Path(__file__).parent.parent / ".env"
if ENV_FILE.exists():
with open(ENV_FILE) as f:from concurrent.futures import ThreadPoolExecutor, as_completed
# Load .env file if exists
ENV_FILE = Path(__file__).parent.parent / ".env"
if ENV_FILE.exists():
with open(ENV_FILE) as f:
for line in f:- [ ] Add timeout per indicator (10s max) - [ ] Test with multiple stocks in sequence - [ ] Measure actual runtime improvement - [ ] Update SKILL.md with new runtime (target: 3-4s) **Expected Impact**: - Reduce runtime from 6-10s to 3-4s per stock
- Extreme risk (80-100): -0.5 (bearish) - [ ] Add to sentiment analysis as 6th indicator - [ ] Test with historical crisis periods - [ ] Update SKILL.md with geopolitical indicator **Expected Impact**: - Early warning for market-wide risk events
GET /portfolios
POST /portfolios
PUT /portfolios/{id}
DELETE /portfolios/{id}
GET /portfolios/{id}/assets
POST /portfolios/{id}/assetsGET /portfolios/{id}/assets
POST /portfolios/{id}/assets
PUT /portfolios/{id}/assets/{ticker}
DELETE /portfolios/{id}/assets/{ticker}
GET /portfolios/{id}/performance?period=weekly
GET /portfolios/{id}/summaryVirusTotal findings are pending for this skill version.
No suspicious patterns detected.