ltp-rapidx-trading

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires reading runtime tokens like previewId and confirmation.submitToken and inserting them verbatim into subsequent MCP/CLI submit commands (continueConsentId), which forces the agent to handle and output sensitive tokens.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The RapidX Trading skill explicitly exposes trade- and account-write APIs and CLI commands for placing, replacing, canceling orders, managing positions, setting leverage, starting automation sessions, and performing live-trade verification. Examples include rapidx/order/place, rapidx/order/place-preview, rapidx/order/replace, rapidx/order/cancel, rapidx/position/close, rapidx/position/set-leverage, rapidx/trade/verify-live, rapidx/automation/start, and their CLI equivalents (e.g., "rapidx order place", "rapidx trade verify-live"). The documentation repeatedly treats these as real production actions (preview→submit flow, confirmation tokens, explicit user consent, notional limits, read-back checks). Because the skill is specifically designed to execute financial transactions (market orders and other trade/banking actions) rather than providing a generic interface, it grants Direct Financial Execution Authority.