alpaca-broker-market-data

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt specifies authenticating by embedding the API key and secret in requests (HTTP headers and the WebSocket auth JSON), which forces the model to include secret values verbatim in generated requests or example code.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's "Live schema workflow" explicitly instructs the agent to fetch https://docs.alpaca.markets/llms.txt (and https://docs.alpaca.markets/llms-full.txt) at runtime to obtain the current documentation index/schemas used when generating code or requests, so remote content could directly control prompts/behavior.