trading212-api

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I flagged this because the document contains literal, high-entropy values that look like an API Key ID and API Secret (not simple placeholders like YOUR_API_KEY). They appear as concrete example credentials and are repeated in an example that constructs an auth header. These are high-entropy, random-looking strings that meet the definition of a secret and could be usable if real.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a Trading 212 API integration that includes authenticated endpoints and explicit POST endpoints to place market, limit, stop, and stop-limit orders (and to cancel orders). It also contains examples for building auth headers and a clear LIVE vs DEMO distinction (real-money trading). These are specific market-order APIs that allow the agent to execute trades (move money/positions) directly.