The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The file lib/defaults.json contains a hardcoded accessKeyId and accessSecret. While labeled as public free-tier keys, shipping active credentials within skill files is a significant security risk.
[DYNAMIC_EXECUTION]: The create_strategy action in scripts/ft-deploy.mjs generates Python strategy files by concatenating strings with user-controlled parameters, including entry_logic and exit_logic. This implementation allows for arbitrary Python code injection into the generated strategy file.
[EXTERNAL_DOWNLOADS]: The skill fetches external resources from well-known sources:
Downloads the uv Python manager via curl | sh from astral.sh in scripts/ft-deploy.mjs.
Clones the official Freqtrade repository from GitHub during the deployment process.
[COMMAND_EXECUTION]: The skill makes extensive use of shell command execution to install system dependencies, manage Python virtual environments, and control the Freqtrade bot processes.
[DATA_EXFILTRATION]: The skill reads sensitive .env files from the workspace and home directory to harvest API keys. While these are used to authenticate with the vendor's API (open.aicoin.com), the broad file access and subsequent network transmission constitute a data exposure risk.
[REMOTE_CODE_EXECUTION]: The deployment script executes the setup.sh script provided by the cloned Freqtrade repository. While this is the official installation method, it involves executing a large, third-party shell script with high privileges over the local environment.

aicoin-freqtrade