aicoin-trading

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains the file lib/defaults.json which includes an AiCoin API Key ID and secret ("ronJ8uI0Yj2soAfGVs5H1YALUIINbE22" and "CWHZcH2us1CLSE7grroR1TpS0Z1JxTwU"). The file explicitly comments that this is a "Public free-tier AiCoin API key". Because these are hardcoded, functional, high-entropy credentials intended for unauthenticated users of the free tier, they represent active secrets embedded within the repository code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation explicitly defines tools and scripts (node scripts/exchange.mjs create_order, close_position, set_stop, set_leverage, etc.) designed specifically for executing financial trades and managing orders on centralized cryptocurrency exchanges (Binance, OKX, Bybit, Bitget, etc.). This meets the criteria for Direct Financial Execution Authority (Risk score 1).