neural-trader

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The README instructs running "npx neural-trader@latest", which at runtime fetches and executes code from the npm registry (https://www.npmjs.com/package/neural-trader), so it relies on an external package that executes remote code.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a trading system whose primary purpose is executing trading strategies. The CLI includes a "run" command with a "--mode <live|paper>" option and describes "Execute a trading strategy" and "real-time market analysis" — indicating live trade execution (market orders) rather than a generic tool. Although broker/connector details are not shown, the package is specifically designed for trading operations, which constitutes direct financial execution capability.