The Agent Skills Directory

[SAFE]: No malicious behaviors, obfuscation, or unauthorized data access were identified across the 28 analyzed files.
[CREDENTIALS_UNSAFE]: The skill explicitly instructs developers not to hardcode credentials. It provides a get_client() helper in scripts/dhan_helpers.py that securely resolves API keys from environment variables (DHAN_CLIENT_ID, DHAN_ACCESS_TOKEN) or an optional local config.json file.
[DATA_EXFILTRATION]: Network operations are restricted to communication with official Dhan API endpoints (api.dhan.co) and the ScanX market data platform (scanx.trade). There is no evidence of sensitive data being sent to unauthorized third-party domains.
[PROMPT_INJECTION]: The skill instructions in SKILL.md include a dedicated 'Safety Rules' section that enforces human-in-the-loop confirmation for order placement, modification, and cancellation, mitigating the risk of autonomous malicious behavior.
[UNVERIFIABLE_DEPENDENCIES]: The skill uses the official dhanhq Python package, which is the standard SDK for the Dhan broker, along with reputable data analysis libraries like pandas and numpy.
[INDIRECT_PROMPT_INJECTION]: Although the skill ingests external market data and option chains, its design requires a readable order preview and explicit confirmation before any action is taken, which serves as a robust defense against potential injection via market data fields.

dhanhq