kelly-invest-webull

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/sync_webull.mjs script executes a local Python bridge using node:child_process.spawnSync. This is used to call the official Webull Python SDK for data fetching as part of its core functionality.- [EXTERNAL_DOWNLOADS]: The skill requires the webull-openapi-python-sdk library to be installed from PyPI to interface with Webull's OpenAPI. Webull is a well-known financial service provider, and the reference is documented neutrally for integration purposes.- [SAFE]: Sensitive Webull credentials (App Key and App Secret) are managed through environment variables rather than hardcoded strings, aligning with standard security practices for secret management.- [SAFE]: The AirApp is designed to be read-only, which is enforced by project-level checks in app/scripts/check.mjs that verify the configuration explicitly disables write procedures and modification capabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 10:36 AM
Security Audit — agent-trust-hub — kelly-invest-webull