registry / opencandle / 0.12.0

opencandle@0.12.0

Open source financial investigator: evidence-first market research agent for your terminal and local GUI

AI Security Review

scanned 16h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked market-analysis CLI/Pi extension with provider API calls and local state.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit opencandle CLI, GUI, or Pi-extension use

Impact

No credential harvesting, stealth persistence, remote payload execution, or unconsented agent-control mutation found.

Mechanism

User-directed market-data, model-provider, and localhost coordinator requests

Rationale

Source inspection found ordinary, explicitly invoked CLI/agent functionality and package-aligned provider requests. No concrete malicious behavior or forbidden install-time control-surface mutation was found.

Evidence

package.jsondist/cli.jsdist/cli-main.jsdist/pi/opencandle-extension.jsdist/config.jsdist/infra/native-dependencies.jsdist/market-state/notification-delivery.js~/.opencandle/config.json~/.opencandle/onboarding.json~/.opencandle/state.db

Network endpoints4

api.openai.com/v1/modelsapi.anthropic.com/v1/modelsquery1.finance.yahoo.com

opencandle@0.12.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code