kelly-invest-webull
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/sync_webull.mjsscript executes a local Python bridge usingnode:child_process.spawnSync. This is used to call the official Webull Python SDK for data fetching as part of its core functionality.- [EXTERNAL_DOWNLOADS]: The skill requires thewebull-openapi-python-sdklibrary to be installed from PyPI to interface with Webull's OpenAPI. Webull is a well-known financial service provider, and the reference is documented neutrally for integration purposes.- [SAFE]: Sensitive Webull credentials (App Key and App Secret) are managed through environment variables rather than hardcoded strings, aligning with standard security practices for secret management.- [SAFE]: The AirApp is designed to be read-only, which is enforced by project-level checks inapp/scripts/check.mjsthat verify the configuration explicitly disables write procedures and modification capabilities.
Audit Metadata