trader-hand-skill

SUSPICIOUS: The skill is internally consistent with a trading assistant and uses official Alpaca endpoints rather than a third-party proxy, so it does not show clear malware or credential-harvesting behavior. However, it materially increases risk by combining untrusted market-content ingestion with the ability to execute real brokerage actions, including live orders and emergency liquidation, making it high-risk despite coherent purpose alignment.

The fragment describes a high-impact autonomous trading workflow rather than malware. It contains no direct malicious payload or obfuscation, but it creates a significant operational security risk because configuration and model-generated signals can ultimately reach shell_exec and real Alpaca order submission when approval is disabled. Secure credential handling, strict command construction, authorization enforcement, external-data sanitization, and independent server-side risk limits should be verified in the unseen implementation.