tradermonty/claude-trading-skills institutional-flow-tracker
Checked the catalogued skill at institutional-flow-tracker.
D; retained sample includes a high finding · SD-007 · what this rule accepts as a false positive →
A set by no findings on this axis
A set by no findings on this axis
9 suppressed by AI triage
The URL is only printed as informational text, not an outbound network call.
Normal client code references public API endpoints, not malicious.
Normal client code references public API endpoints, not malicious.
Defines base URL for legitimate API calls, not malicious.
Hardcoded URL for API client, not malicious.
The string is an informational message; it does not initiate a network call or grant permissions.
The file is documentation and the outbound call is an example, not executable code.
Documentation contains a note about outbound network calls, not actual code or configuration that would execute them.
The line only prints a URL for obtaining an API key; no outbound network call or permission grant is performed.