tradingview-reader
Read TradingView desktop app for market data, news, alerts, watchlists, and screener results using opencli (read-only). Use this skill whenever the user wants quotes, options chains, options expiries, screener results across stocks/crypto/forex/futures/bonds, gainers/losers/movers, news headlines or full story bodies, alerts (active list, fire log, offline fires), watchlists including colored flag lists, symbol search/autocomplete, chart state, or screenshots from their local TradingView.app. Triggers include: "options chain for X", "IV on Y", "show me SNDK puts", "TV screener for Y sector", "screen oversold stocks", "TV gainers", "crypto by market cap", "TradingView news on AAPL", "show my watchlists", "red flag list", "list my alerts", "what alerts fired", "search TV for nvidia", "what symbol is on my chart", "screenshot NVDA chart", "TradingView IV skew", "TV expiries for X". This skill is READ-ONLY — it does NOT place trades, modify watchlists, or change chart layouts.
72
89%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Security
1 critical severity finding. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
The skill intentionally harvests session cookies via CDP and relaunches TradingView with a remote-debugging port—capabilities that enable reuse or exfiltration of authenticated session tokens and expose a local debug HTTP endpoint, and the docs contain a contradictory claim about "no cookie extraction", which is suspicious.
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
TradingView Reader runtime path connects to the user’s already-running TradingView.desktop app over CDP and then ingests free-text news story bodies (e.g., `opencli tradingview news --id ...`) which can originate from outsider-authored publishers on the TradingView feed.
- Repository
- himself65/finance-skills
- Commit
81e1f50
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.