orderflow-analysis

Warn

Audited by Snyk on Feb 15, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is explicitly designed for trading (financial operations) and references trading providers and execution flow. It names an active L2 data connection provider "Alpaca Pro" (a broker API capable of placing orders), refers to "market orders", includes a validation call validate_signal(..., quantity: float) that produces an approval result, and shows execution in the example via execute_confirmed_trade(result). While the skill primarily analyzes orderflow, it explicitly incorporates trading execution concepts and a callable execution step (execute_confirmed_trade) in its workflow. These are specific market-order/execution elements (not generic tooling), so it constitutes direct financial execution capability.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Feb 15, 2026, 09:32 PM