freqtrade-bot

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). Yes — the skill includes installation steps that clone and run remote code (e.g., git clone https://github.com/freqtrade/freqtrade followed by ./setup.sh -i, and similar git clone + install steps for https://github.com/pst-group/pysystemtrade and https://github.com/AI4Finance-Foundation/FinRL-Trading), which fetch and execute external code that the skill depends on.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a crypto trading framework (Freqtrade) that lists supported exchanges (Binance, Kraken, Bybit, OKX, Gate.io), includes "live trading" CLI commands (freqtrade trade --strategy ...) and Telegram commands that force buy/close trades (/forceenter, /forceexit). The description and examples imply integration with exchange/broker APIs and the ability to submit market/live orders. Knowledge injections further show live broker integrations (Alpaca, Interactive Brokers) and API order submission examples. This is specifically designed to execute financial transactions (market orders), not a generic tool, so it grants direct financial execution capability.