algo-setup

Warn

Audited by Snyk on Apr 26, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is specifically designed for algorithmic trading setup: it scaffolds an OpenAlgo execution environment, requires an OPENALGO_API_KEY, and explicitly references generating a strategy for a specific asset/exchange (e.g., "ema-crossover SBIN NSE 5m") and running OpenAlgo at a local execution endpoint. Although it focuses on environment/setup, its primary, explicit purpose is to enable trading execution (market/order strategies) rather than being a generic tool. This meets the criteria for Direct Financial Execution (market orders/asset trading).

MEDIUM W013: Attempt to modify system services in skill instructions.

  • Attempt to modify system services in skill instructions detected (high risk: 0.80). The prompt instructs installing system-level packages with sudo (e.g., apt install libta-lib-dev and build-essential), which directs the agent to perform privileged system changes even though it doesn't request account creation or bypasses.

Issues (2)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

W013
MEDIUM

Attempt to modify system services in skill instructions.

Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 26, 2026, 10:07 PM
Issues
2