breakout-trade-planner
Generate Minervini-style breakout trade plans from VCP screener output with worst-case risk calculation, portfolio heat management, and Alpaca-compatible order templates (stop-limit bracket for pre-placement, limit bracket for post-confirmation). Use when user has VCP screener results and wants actionable trade plans with entry/stop/target levels and position sizing.
70
86%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Medium
Suggest reviewing before use
Security
1 medium severity finding. This skill can be installed but you should review these findings before use.
W009: Direct money access capability detected (payment gateways, crypto, banking).
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
The skill explicitly generates Alpaca API-compatible order templates and "Actionable Orders" for breakout candidates (lines referencing Alpaca and order templates). This is a specific trading/order-generation capability tied to a brokerage API (market orders/broker execution), which constitutes direct financial execution capability even if the skill itself only outputs templates rather than submitting orders.
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow reads outsider-authored VCP screener JSON from a runtime-supplied local file path (`scripts/plan_breakout_trades.py:45-47` via `load_input(--input)`), and then turns fields like `company_name`/`sector`/`reason` into Markdown/JSON that the agent can present—i.e., the LLM context would be affected by untrusted free text from that JSON.
- Repository
- tradermonty/claude-trading-skills
- Commit
62a1635
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.