toss-securities
Warn
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user/agent to install a CLI tool
tossctlfrom a third-party GitHub repository (JungHoonGhae/tossinvest-cli) using Homebrew. This source is not verified or official. - [REMOTE_CODE_EXECUTION]: The skill executes external binaries (
tossctl) and imports a third-party Node.js package (toss-securities) that are downloaded from unverified external sources. - [COMMAND_EXECUTION]: The workflow relies on executing shell commands to perform authentication and retrieve data. If user-provided ticker symbols or arguments are not properly sanitized before being passed to
tossctl, it could lead to command injection. - [DATA_EXPOSURE]: The skill is designed to handle highly sensitive financial information, including account summaries, portfolio compositions, and order histories. While the instructions include warnings to be conservative with sensitive data, the information is processed within the agent's context and potentially exposed in the conversation history.
Audit Metadata