weex-trader-skill

Warn

Audited by Snyk on Jun 25, 2026

Risk Level: MEDIUM
Full Analysis

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

  • Direct money access detected (high risk: 1.00). The skill is explicitly a trading integration: it provides contract/futures and spot REST entrypoints (scripts/weex_contract_api.py, scripts/weex_spot_api.py), order preview and live-order flows (scripts/weex_trade_guard.py, scripts/weex_order_intent_state.py), and CLI guidance for submitting mutating requests to WEEX (including demo vs real trading flags). The manifest requires storing API key/secret/passphrase and signing private requests, and it documents confirmation flags for live/demo execution — all of which indicate the skill is specifically designed to place market orders and manage account/trading state. This is a direct financial execution capability (placing trades, mutating account state) rather than a generic tool.

Issues (1)

W009
MEDIUM

Direct money access capability detected (payment gateways, crypto, banking).

Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 25, 2026, 12:35 PM
Issues
1
Security Audit — snyk — weex-trader-skill