tradingview-api-integration
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill includes instructions to download an OpenAPI specification file from
https://www.tradingviewapi.com/openapi.jsonto keep the local endpoint catalog updated. This is a common practice for maintaining API compatibility. - [COMMAND_EXECUTION]: The skill provides examples of using
curland a bundled Python script (scripts/tv_api.py) to interact with the API. The script follows standard practices for HTTP requests and includes local API key storage with restrictive permissions (chmod 600) upon user consent. - [REMOTE_CODE_EXECUTION]: Automated scans flagged the download of
openapi.jsonas a potential remote code execution vector. However, static analysis of the file usage shows it is treated as a passive data file (JSON) for schema reference and path listing, not as an executable script or configuration that influences runtime execution flow.
Recommendations
- HIGH: Downloads and executes remote code from: https://www.tradingviewapi.com/openapi.json - DO NOT USE without thorough review
- CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata