tradingcodex-investment-workflow
Warn
Audited by Snyk on Jul 2, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). This skill is explicitly a trading/investment execution system. It defines order lifecycle services (create_ticket, submit_ticket, cancel_ticket, get_ticket_status), broker integrations (example AlpacaProvider with API key/secret and base URL), and MCP tools named tradingcodex_submit_order_ticket, tradingcodex_cancel_order_ticket, tradingcodex_get_order_status, etc. The README shows code that registers a broker provider and submits orders (market/limit) and describes environment flags and provider registration required to enable live execution. Those are specific payment/trading APIs and direct order-submission capabilities (including live broker provider integration), not generic tooling. Therefore it grants Direct Financial Execution Authority.
Issues (1)
W009
MEDIUMDirect money access capability detected (payment gateways, crypto, banking).
Audit Metadata