Alpaca Py Cli

• Analyzed: May 12, 2026, 4:17 AM
• Findings: 1
• Version: 2.0.0
• Hash: 0ef5d17acc450944b8aa530b4741dc9972fd2bebecc81b601f74e437f975e113
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its inherent high-risk capabilities, specifically the modification of shell configuration files (~/.zshrc, ~/.bashrc, ~/.profile) to persistently store sensitive API keys for financial trading. While the skill's documentation (SKILL.md, README.md, setup.json) provides extensive and explicit warnings against autonomous agent actions and emphasizes the need for user consent for setup, the capability to alter shell configuration and handle financial credentials represents a significant security concern if misused or if an agent fails to adhere to the provided safety instructions. There is no evidence of malicious intent such as data exfiltration or backdoor installation; rather, the documentation actively attempts to mitigate prompt injection risks by instructing agents to seek explicit user permission for sensitive operations.