us-stock-trading

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill prompt contains hardcoded API keys and secret keys directly in the markdown documentation, which presents a credential leakage risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The workflow reads financial news and external web search results during its daily portfolio reporting cron job, exposing the agent to outsider-authored free text.

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). The documentation contains concrete, high-entropy API credentials for Alpaca Paper Trading (API Key ID: PK5ZMJM5OF7DAA6EU2PKVXI5Z7 and Secret Key: 8mKU43vRGzgM3QFLwdTex1n3Li5FgEGehyVxJJi5Ags1), along with an Account ID. These appear to be actual, functional test/paper credentials rather than standard documentation placeholders like "YOUR_API_KEY".

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation explicitly configures and implements direct US stock trading via the Alpaca Paper Trading API (alpaca-py). It provides setup, credentials, and explicit code for placing market orders using client.submit_order() and MarketOrderRequest, which falls under Market Orders (buying/selling assets/stocks).