eel-strategy

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README/install steps fetch and install remote code that is then executed by the runtime (npx https://github.com/Senpi-ai/senpi-skills to install the senpi-trading-runtime plugin and curl https://raw.githubusercontent.com/Senpi-ai/senpi-skills/main/eel/... to download eel producer scripts which are later run with python), so external content is fetched and executed and is a required runtime dependency.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is an explicit trading/portfolio execution system: it names wallets (EEL_LONG_WALLET, EEL_SHORT_WALLET), defines order mechanics (FEE_OPTIMIZED_LIMIT with taker fallback), leverage, per-position margin, drawdown halts, and a producer daemon that "serves both books" and "emits entries" — i.e., it places trades. The doc even references execution tool names (create_position, close_position, edit_position, ratchet_stop_, cancel_order, strategy_close) and a hard rule forbidding user sessions from calling them, which confirms those are actionable execution APIs. This is not a generic tool — it is specifically designed to send market orders/manage positions and control wallets, so it grants direct financial execution capability.