tradingcodex-investment-workflow

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill instructs installation of the tradingcodex package via GitHub (git+https://github.com/monarchjuno/tradingcodex.git@main), which is an unofficial third-party repository and constitutes a high-risk unverifiable runtime dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill documentation describes TradingCodex, an investment workflow framework that explicitly includes features for submitting market orders and integrating with broker APIs (such as Alpaca) for live or paper trading execution. These are specific functions for direct financial execution (market orders and broker integrations), meeting the criteria for a risk score of 1.