osprey-strategy

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The README install steps explicitly fetch and then run remote runtime files and scripts from https://raw.githubusercontent.com/Senpi-ai/senpi-skills/main/osprey/... (and install https://github.com/Senpi-ai/senpi-skills), which would supply the runtime.yaml decision_prompt and executable producer code—so these URLs deliver code and prompts that the agent relies on and will execute.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a trading strategy explicitly designed to enter and manage trades on an exchange (XYZ/Hyperliquid). It uses language that indicates order execution and position management: "producer enters", "LONG / SHORT the proxy", "taker-true entry", DSL presets for ladder orders, max_loss, timeouts, and DSL-driven exit behavior. This is a specific tool to buy/sell assets (market orders/position management) rather than a generic capability. Therefore it grants direct financial execution authority.