orderflow-analysis
Warn
Audited by Snyk on Feb 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill is explicitly designed for trading (financial operations) and references trading providers and execution flow. It names an active L2 data connection provider "Alpaca Pro" (a broker API capable of placing orders), refers to "market orders", includes a validation call validate_signal(..., quantity: float) that produces an approval result, and shows execution in the example via execute_confirmed_trade(result). While the skill primarily analyzes orderflow, it explicitly incorporates trading execution concepts and a callable execution step (execute_confirmed_trade) in its workflow. These are specific market-order/execution elements (not generic tooling), so it constitutes direct financial execution capability.
Audit Metadata