alpaca-cli-regenerate

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's Phase 1 explicitly pulls OpenAPI specs from docs.alpaca.markets (downloads trading-api.json and market-data-api.json via make spec-update) and those external spec files are read by the generator to create CLI commands, so upstream third-party content can change generated behavior and thus influence tool actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly pulls Alpaca trading API OpenAPI specs and generates trading client methods and CLI commands (e.g., internal/api/trading_client.gen.go, command registry entries including order submit hooks). It is specifically tailored to a brokerage/trading API (market orders) and references order submission behavior and integration tests that require API keys — i.e., it is designed to enable direct market-order/transaction interactions rather than being a generic tool. This meets the "Market Orders (Buying/Selling stocks or assets)" criterion for Direct Financial Execution.