bot-ops

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill clearly calls the dashboard API at http://raspberrypi.local:8080 (GET and dangerous POST endpoints such as /api/close and /api/trading) at runtime to perform actions on the Pi, and the restart script runs docker compose pull/up which fetches and executes the remote container image ghcr.io/lgbarn/keltner-bot:latest — both are runtime external dependencies that can execute remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a trading-bot operations doc. It exposes and documents trading-specific APIs and controls that can execute market actions: e.g., POST /api/close (force close all positions), POST /api/trading (toggle trading on/off), and /api/orders (open/working orders). The repo/scripts also include direct SSH/curl commands to change trading configuration and restart the bot (which enables/disables live trading). These are specific, purpose-built controls for placing/closing trades and managing trading execution, so this grants direct financial execution capability.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt directs the agent to run SSH commands that change system state (editing .env, running sqlite3 updates, restarting containers, running Ansible deploys) and explicitly invokes sudo to delete logs, so it instructs actions that require root privileges and can modify the host system.