registry / opencandle / 0.11.0

opencandle@0.11.0

Financial trading & investing agent

AI Security Review

scanned 16h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A declared Pi agent extension activates when the user runs it and performs first-party model/provider setup. No concrete malicious or unconsented install-time attack was found.

Static reason

No blocking static signals were detected.

Trigger

User installs/loads the Pi extension and starts an OpenCandle session.

Impact

The extension can solicit and store user-supplied API credentials for its finance-agent functions.

Mechanism

Agent-extension startup setup and local credential persistence

Rationale

No malicious install-time behavior or credential theft was found. Warn because the package is an agent extension with startup credential-setup capability.

Evidence

package.jsonsrc/pi/opencandle-extension.tssrc/onboarding/connect.tssrc/config.tssrc/infra/native-dependencies.ts

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Benign with medium false-positive risk.

Evidence for warning

package.json declares a Pi extension: dist/pi/opencandle-extension.js.
src/pi/opencandle-extension.ts runs setup on session_start and registers agent tools.

opencandle@0.11.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code