algo-trading

Warn

Audited by Snyk on Mar 5, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is explicitly designed to perform automated trading and contains concrete, actionable financial execution capabilities. It documents integration with broker APIs (Alpaca, Robinhood), provides a concrete API call for placing orders (POST https://api.alpaca.markets/v2/orders with order body), includes runtime commands and functions to execute trades (e.g., oc.execute_trade('TSLA', 'sell', 5'), oc.run_live --broker alpaca --key $ALPACA_KEY), and describes setting broker API keys and live/sandbox flags. These are direct market-order execution features (placing buy/sell orders), not generic tooling, and therefore constitute Direct Financial Execution authority.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 5, 2026, 10:46 PM