📦
Audit History
longbridge-technical - 6 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v6 Latest | Aug 8, 2026, 10:01 AM | 2 confirmed | 7 | No capability change |
| v5 | Jul 23, 2026, 06:24 PM | 1 confirmed | 9 | No capability change |
| v4 | Jul 8, 2026, 05:21 AM | 1 confirmed | 8 | No capability change |
| v3 | Jul 5, 2026, 09:23 PM | 1 confirmed | 11 | Env variables |
| v2 | Jun 30, 2026, 08:21 AM | No confirmed findings | 2 | Filesystem access |
| v1 | Jun 8, 2026, 11:15 AM | No confirmed findings | 0 | Baseline |
Audit version 6 Latest
Aug 8, 2026, 10:01 AM
Most alerts are false positives from Markdown backticks, calculations, multilingual text, and conventional device redirection. Package installation and predictable temporary paths present genuine risks. Missing relative scripts and unquoted symbol placeholders add command-execution exposure.
10
Files scanned
1,737
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Unvalidated Symbol Interpolation in Shell Commands
Shell examples place user-supplied symbols directly into commands without validation or quoting. Metacharacters could alter commands when substituted verbatim.
The command templates visibly interpolate symbol placeholders without quoting or an allowlist. Exploitation depends on verbatim shell construction from untrusted input.
High
Missing Relative Script Creates Path-Hijack Risk
The skill directs execution of scripts/signal_engine.py, but the package contains no script. A same-named working-directory file could execute without provenance.
The documented command executes a relative Python path, while the complete package tree has no scripts directory. This directly enables unintended local code execution.
Capability review items (7)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Temp directory access
- Always redirect CLI output to a temp file (e.g. `/tmp/kline_day.json`) — the CLI may
The skill mandates a predictable shared temporary path. Another local process could replace or read this file before analysis.
Medium
Temp directory access
python3 scripts/signal_engine.py --kline /tmp/kline_day.json --symbol SYMBOL
The analysis script reads a fixed file under /tmp. Predictable names permit input tampering and symlink attacks.
Medium
Temp directory access
python3 scripts/signal_engine.py --kline /tmp/kline_day.json --symbol AAPL.US
This command reads market data from the same predictable shared path. The file lacks uniqueness, ownership checks, and integrity validation.
Medium
Ruby/shell backtick execution
Auto-detect fractal (分型), bi (笔), zhongshu (中枢), buy/sell signals (1/2/3 buy). Requires `pip install
The skill directs users to install czsc with pip. Package installation can execute build hooks and introduces supply-chain risk.
Medium
Ruby/shell backtick execution
BOS (Break of Structure), ChoCH, FVG (Fair Value Gap), Order Block detection. Requires `pip install
The skill directs installation of smartmoneyconcepts. Unpinned Python packages can execute installation code and change the environment.
Medium
Ruby/shell backtick execution
| `ModuleNotFoundError: czsc` | Run `pip install czsc` before using Chan Theory |
This line explicitly instructs pip to install an unpinned third-party package. Installation may execute package-controlled code.
Medium
Ruby/shell backtick execution
| `ModuleNotFoundError: smartmoneyconcepts` | Run `pip install smartmoneyconcepts` before using SMC
This line explicitly instructs pip to install smartmoneyconcepts without a version or hash. That creates supply-chain exposure.
Risk Factors
📁 Filesystem access (5)
🔑 Env variables (4)
Audited by: codex
Jul 23, 2026, 06:24 PM
Most static matches are Markdown syntax, prose, calculations, or safe device redirection. Confirmed risks include predictable shared temporary files, shell commands with a user-derived symbol, unpinned package installation, and automatic access to sensitive brokerage data.
10
Files scanned
1,735
Lines analyzed
13
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
SKILL.md:10-14references/turtle-signal.md:101-106references/turtle-signal.md:250-252references/turtle-signal.md:276-289
Undisclosed Automatic Brokerage Data Access
The metadata claims no login is required, but the Turtle workflow automatically reads net assets, positions, and order history. A prohibition on unauthorized access exists, yet the workflow contains no explicit consent gate.
The cited workflow explicitly prioritizes automatic account queries while the root metadata says no login is required. The only consent language is a prohibition, not an implemented confirmation step.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Temp directory access
- Always redirect CLI output to a temp file (e.g. `/tmp/kline_day.json`) — the CLI may
The workflow directs agents to store market data in a predictable shared /tmp path. Another local process could replace or read that file through a collision or symbolic link.
Medium
Temp directory access
python3 scripts/signal_engine.py --kline /tmp/kline_day.json --symbol SYMBOL
The command reads the predictable /tmp/kline_day.json path created earlier. Shared temporary paths can expose the analysis to tampered input.
Medium
Temp directory access
python3 scripts/signal_engine.py --kline /tmp/kline_day.json --symbol AAPL.US
The usage example again consumes a fixed file in the shared temporary directory. It does not establish private creation, ownership checks, or cleanup.
Medium
Ruby/shell backtick execution
```bash
The Bash example runs the Longbridge CLI with a symbol derived from user input. Without strict validation and argument-safe invocation, crafted symbol text could alter the shell command.
Medium
Ruby/shell backtick execution
- **If `longbridge` CLI is installed** (via `longbridge-market-data` or standalone): run the command
The instruction tells the agent to run the earlier shell command directly. Its symbol placeholder originates from user input and the root instructions provide no strict validation rule.
Medium
Ruby/shell backtick execution
Auto-detect fractal (分型), bi (笔), zhongshu (中枢), buy/sell signals (1/2/3 buy). Requires `pip install
The skill recommends installing the unpinned czsc package from PyPI. Package installation executes third-party setup code and creates a supply-chain exposure.
Medium
Ruby/shell backtick execution
BOS (Break of Structure), ChoCH, FVG (Fair Value Gap), Order Block detection. Requires `pip install
The skill recommends an unpinned smartmoneyconcepts installation. Installing an unresolved package version can execute unreviewed third-party code.
Medium
Ruby/shell backtick execution
| `ModuleNotFoundError: czsc` | Run `pip install czsc` before using Chan Theory |
The error guidance explicitly tells users or agents to run an unpinned pip install for czsc. That operation executes code from a mutable third-party package.
Medium
Ruby/shell backtick execution
| `ModuleNotFoundError: smartmoneyconcepts` | Run `pip install smartmoneyconcepts` before using SMC
The error guidance explicitly recommends an unpinned smartmoneyconcepts installation. This introduces third-party package execution without version or hash verification.
Risk Factors
📁 Filesystem access (5)
🔑 Env variables (4)
Audited by: codex
Jul 8, 2026, 05:21 AM
Most static findings are Markdown or market-analysis false positives, including configuration, system-reconnaissance, /dev/null, and entropy detections. Confirmed risks remain for fixed /tmp file usage, local CLI execution, third-party Python package installation guidance, and sensitive Longbridge account-data access in the Turtle Trading workflow.
10
Files scanned
1,735
Lines analyzed
12
Review items
0
False positives ignored
Confirmed security concerns (1)
High
references/turtle-signal.md:68-70references/turtle-signal.md:283-289references/turtle-signal.md:297-301references/turtle-signal.md:597
Sensitive Financial Account Data Access
The Turtle Trading module instructs use of Longbridge assets, positions, and order history to calculate units and trading exceptions. These commands can expose net assets, holdings, and order history unless explicit consent is enforced for every account-scoped read.
The cited workflow directly calls account-scoped Longbridge commands and notes that the CLI uses the currently logged-in account. A positions consent guardrail exists, but assets and order history are still described as automatic reads.
Capability review items (8)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Temp directory access
- Always redirect CLI output to a temp file (e.g. `/tmp/kline_day.json`) — the CLI may
The skill instructs agents to write CLI output to a fixed /tmp path. Predictable temp files can be tampered with or exposed on shared hosts.
Medium
Temp directory access
python3 scripts/signal_engine.py --kline /tmp/kline_day.json --symbol SYMBOL
The example consumes /tmp/kline_day.json as an analysis input. A fixed temp path can allow stale or replaced data to influence results.
Medium
Temp directory access
python3 scripts/signal_engine.py --kline /tmp/kline_day.json --symbol AAPL.US
The usage example repeats a predictable /tmp input path. This is a real filesystem risk when an agent follows the workflow on a shared machine.
Medium
Ruby/shell backtick execution
- **If `longbridge` CLI is installed** (via `longbridge-market-data` or standalone): run the command
The skill instructs agents to run a local Longbridge CLI command. This creates an external execution path through a PATH-resolved binary, even though the intended operation is read-only.
Medium
Ruby/shell backtick execution
Auto-detect fractal (分型), bi (笔), zhongshu (中枢), buy/sell signals (1/2/3 buy). Requires `pip install
The skill directs use of a third-party Python package installed through pip. Package installation can execute untrusted install hooks or introduce supply-chain risk.
Medium
Ruby/shell backtick execution
BOS (Break of Structure), ChoCH, FVG (Fair Value Gap), Order Block detection. Requires `pip install
The skill references installing smartmoneyconcepts from the Python package ecosystem. That is a real external dependency risk if agents or users follow it blindly.
Medium
Ruby/shell backtick execution
| `ModuleNotFoundError: czsc` | Run `pip install czsc` before using Chan Theory |
The error handling table tells users to run pip install for czsc. Installing packages from PyPI is a supply-chain risk and should require explicit confirmation.
Medium
Ruby/shell backtick execution
| `ModuleNotFoundError: smartmoneyconcepts` | Run `pip install smartmoneyconcepts` before using SMC
The error handling table tells users to run pip install for smartmoneyconcepts. This can install untrusted code and should not be automatic.
Risk Factors
📁 Filesystem access (5)
🔑 Env variables (4)
Audited by: codex
Jul 5, 2026, 09:23 PM
Most static findings are false positives from markdown formatting, finance terminology, math examples, and readable multilingual text. Confirmed findings are limited to intentional local command execution and package-install guidance in SKILL.md. The Turtle workflow also handles sensitive account data, so agents must require explicit user consent before account reads.
10
Files scanned
1,734
Lines analyzed
15
Review items
0
False positives ignored
Confirmed security concerns (1)
Medium
references/turtle-signal.md:43references/turtle-signal.md:68-71references/turtle-signal.md:527-539references/turtle-signal.md:575-597
Sensitive Account Data Access Workflow
The Turtle workflow can request or read account assets, positions, order history, and watchlists through the Longbridge CLI. This is not malicious by itself, but it creates a privacy risk if agents run those commands without explicit user consent.
The file directly lists assets, positions, order history, and watchlist commands, then shows workflows that call them. A guard against unauthorized position reads exists, so the risk is controlled but still real.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Ruby/shell backtick execution
```bash
The fenced block instructs the agent to run the local longbridge CLI with a user-selected symbol. Executing local commands from skill instructions requires user confirmation and input validation.
Medium
Ruby/shell backtick execution
```
The surrounding text tells the agent to invoke longbridge kline help. It is low-risk but still directs execution of an external local binary.
Medium
Ruby/shell backtick execution
Use `longbridge kline --help` for period and date-range options.
The line explicitly instructs using longbridge kline --help. Running external CLI tools is a real execution surface even when the immediate command is informational.
Medium
Ruby/shell backtick execution
- **If `longbridge` CLI is installed** (via `longbridge-market-data` or standalone): run the command
The line says to run the Longbridge CLI command directly when installed. That invokes local software and should not happen without explicit user intent.
Medium
Ruby/shell backtick execution
- **If neither is available**: tell the user to install `longbridge-terminal` first, then re-run.
The range includes installer guidance and optional dependency instructions. Installing or invoking local tooling changes the execution environment and needs confirmation.
Medium
Ruby/shell backtick execution
Auto-detect fractal (分型), bi (笔), zhongshu (中枢), buy/sell signals (1/2/3 buy). Requires `pip install
The line requires pip install czsc for Chan Theory workflows. Package installation can execute untrusted setup code and changes the local Python environment.
Medium
Ruby/shell backtick execution
BOS (Break of Structure), ChoCH, FVG (Fair Value Gap), Order Block detection. Requires `pip install
The line requires pip install smartmoneyconcepts for SMC workflows. Installing packages is a supply-chain and environment-modification risk.
Medium
Ruby/shell backtick execution
All frameworks are analytical — no CLI login required. Data fetching via `longbridge kline` is publi
The line documents data fetching through longbridge kline. That is an intentional external command dependency and should be gated by user consent.
Medium
Ruby/shell backtick execution
| `command not found: longbridge` | Install longbridge-terminal first; use to fetch kline data |
The error-handling table tells users to install longbridge-terminal. Installation guidance is a real environment-change risk even though it is not malicious.
Medium
Ruby/shell backtick execution
| `ModuleNotFoundError: czsc` | Run `pip install czsc` before using Chan Theory |
The line instructs running pip install czsc after an import error. That can execute package installation code and alter the environment.
Medium
Ruby/shell backtick execution
| `ModuleNotFoundError: smartmoneyconcepts` | Run `pip install smartmoneyconcepts` before using SMC
The line instructs running pip install smartmoneyconcepts after an import error. This creates a package supply-chain and local environment risk.
Risk Factors
📁 Filesystem access (5)
🔑 Env variables (4)
Audited by: codex
Jun 30, 2026, 08:21 AM
Static analysis produced many command, filesystem, environment, weak-crypto, reconnaissance, and entropy hits. Review found the command hits are mainly Markdown examples and intended Longbridge CLI workflows, while weak-crypto, reconnaissance, env_access, and entropy hits are false positives from trading terminology, formatting, or multilingual text. The remaining real risk is moderate because the skill can run CLI commands, install third-party Python packages, write temp files, and access account-related Longbridge data when the user authorizes it.
10
Files scanned
1,734
Lines analyzed
4
Review items
1
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
SKILL.md:31-37references/chanlun.md:11-16references/smc.md:11-16references/elliott-wave.md:42-56references/elliott-wave.md:264-280
External CLI Commands and Package Installation
The skill instructs the assistant to run Longbridge CLI commands for market data and help output, and to install third-party Python packages for Chan Theory, Smart Money Concepts, and Elliott Wave support. This is legitimate for the skill purpose, but it executes local commands and depends on external packages.
The referenced lines contain direct command examples and dependency installation instructions. The commands match the skill purpose and do not show malicious payloads, so the concern is operational risk rather than confirmed abuse.
Medium
references/turtle-signal.md:66-74references/turtle-signal.md:247-253references/turtle-signal.md:276-289references/turtle-signal.md:514-519references/turtle-signal.md:560-569
Account and Portfolio Data Access Through Longbridge CLI
The Turtle Trading workflow can call Longbridge assets, positions, orders, and watchlist commands to calculate unit sizing, exits, and scans. This may expose account value, holdings, order history, and watchlist data to the assistant context when the user is logged in.
The file explicitly lists account, positions, orders, and watchlist commands and describes when to call them. The same file also says not to read holdings without user authorization, which lowers maliciousness but not privacy impact.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
references/elliott-wave.md:23-24references/elliott-wave.md:101-105references/elliott-wave.md:212-215references/turtle-signal.md:1-8references/technical.md:63-64
Static High-Risk Pattern False Positives
The weak cryptography, system reconnaissance, env_access, and entropy alerts are not supported by malicious context. They map to trading words such as index codes and market environment, Markdown tables, examples, and multilingual documentation rather than crypto routines, host reconnaissance, environment variable access, or obfuscated payloads.
Manual review of the cited lines found market-analysis terminology and documentation structure, not dangerous implementation code. Confidence is high, though the full static list was large and grouped for review.
Risk Factors
⚙️ External commands (6)
Detected Patterns
Shell Command Execution InstructionsTemporary File and Device Redirection Usage
Audited by: codex
Jun 8, 2026, 11:15 AM
Prompt-only documentation skill containing markdown reference files that describe technical analysis frameworks (candlestick, Ichimoku, Elliott Wave, Chan Theory, SMC, Turtle). No executable scripts or code files are shipped. All static findings are false positives: the 291 'backtick execution' hits are triple-backtick markdown code blocks containing bash/Python examples that the LLM is expected to interpret, not actually executed code. The 'weak crypto', 'system reconnaissance', and 'config library' hits are false matches on ticker symbols (SPX/HSI), CLI invocation examples, and financial documentation terms. No prompt injection, exfiltration, or malicious intent detected.
10
Files scanned
1,734
Lines analyzed
1
Review items
0
False positives ignored
Risk Factors
⚙️ External commands (1)
Audited by: claude