us-stock-data

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill prompt explicitly embeds a hardcoded Alpaca API key (PK5ZMJM5OF7DAA6EU2PKVXI5Z7) and secret (8mKU43vRGzgM3QFLwdTex1n3Li5FgEGehyVxJJi5Ags1) directly into code examples, which violates secure credential handling practices by exposing real secrets in the agent's context and output.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains several service tokens and API keys, such as Alpaca (PK5ZMJM5OF7DAA6EU2PKVXI5Z7 and 8mKU43vRGzgM3QFLwdTex1n3Li5FgEGehyVxJJi5Ags1) and Alpha Vantage (V03ZKLQR9FW5N7VF). While these are presented in documentation / setup instructions for specific paper/free tier accounts, they represent literal, high-entropy credentials that provide active access to third-party services.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL.md file explicitly integrates the Alpaca Trading API, including Python code examples that import TradingClient and MarketOrderRequest to submit market orders (e.g., client.submit_order(...)). This constitutes direct financial execution capability via market order placement.