CtrlK
BlogDocsLog inGet started
Tessl Logo

llm-trading-agent-security

Security patterns for autonomous trading agents with wallet or transaction authority. Covers prompt injection, spend limits, pre-send simulation, circuit breakers, MEV protection, and key handling. Use when an autonomous agent holds wallet or transaction authority and its limits, simulation, or key handling need review.

69

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

The canonical home for this skill is tdg-personal/llm-trading-agent-security

SKILL.md
Quality
Evals
Security

Quality

Content

75%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A focused, code-heavy security skill with executable patterns and a validation-oriented pre-deploy checklist. Main gaps are a few undefined helper stubs and the absence of an explicit sequential deploy/retry workflow.

Suggestions

Define or stub the helper methods (_get_24h_spend, _record_spend, decode_uint256) so the examples are fully copy-paste executable.

Add a short numbered pre-deploy workflow (e.g., configure limits -> simulate -> send -> log) with an explicit validate-and-retry loop to raise workflow clarity.

Consider moving the longer code examples into a references/ file linked from the body to improve progressive disclosure.

DimensionReasoningScore

Conciseness

Largely lean with brief framing and tight code commentary that assumes competence; a few introductory sentences ('harsher threat model...', 'Layer the defenses') could be trimmed.

4 / 5

Actionability

Provides concrete, mostly copy-paste-ready Python for each pattern, but a few undefined helper stubs (_get_24h_spend, _record_spend, decode_uint256) prevent fully executable code.

4 / 5

Workflow Clarity

The Pre-Deploy Checklist supplies explicit validation checkpoints and the guard patterns enforce them for a destructive domain, though no sequential deploy workflow or validate-fix-retry feedback loop is spelled out.

4 / 5

Progressive Disclosure

Well-organized into clear sections (When to Use, How It Works, Examples, Pre-Deploy Checklist) with no nested references; inline pattern catalog is appropriate, though a dedicated references file could offload the six examples.

4 / 5

Total

16

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A well-crafted description that concisely names a specific niche, enumerates concrete capabilities, and provides an explicit 'Use when' trigger. Only minor room for improvement in trigger-term synonym coverage.

DimensionReasoningScore

Specificity

Lists multiple concrete security patterns (prompt injection, spend limits, pre-send simulation, circuit breakers, MEV protection, key handling) with comprehensive coverage of the stated threat surface.

5 / 5

Completeness

Explicitly states both what it covers ('Covers prompt injection, spend limits...') and when to use it ('Use when an autonomous agent holds wallet or transaction authority...') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Strong natural keywords like 'autonomous trading agents' and 'wallet or transaction authority need review', but lacks exhaustive synonyms or file-type triggers that would warrant a 5.

4 / 5

Distinctiveness Conflict Risk

Clear, narrow niche (autonomous trading agents with transaction authority) with distinct triggers that are unlikely to fire for unrelated skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
affaan-m/ECC
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.