Is jatinbansal1998/zerodha-kite safe?
Use with caution. jatinbansal1998/zerodha-kite is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the zerodha-kite skill by jatinbansal1998 a trust score of 76/100 with 4 findings (1 critical, 1 high).
https://github.com/openclaw/skills/tree/main/skills/jatinbansal1998/zerodha-kite
Is jatinbansal1998/zerodha-kite safe to install?
This skill provides legitimate CLI routing functionality for Zerodha trading commands but contains critical security issues in its installation instructions. It instructs users to download and execute shell scripts directly from the internet, bypassing normal security controls, which poses significant risk of system compromise.
What security issues were found in jatinbansal1998/zerodha-kite?
Category Scores
Findings (4)
CRITICAL Dangerous Script Execution Instructions -60 ▶
The skill instructs users to download and execute shell scripts directly from the internet using curl/wget piped to sh, which completely bypasses security controls and could lead to arbitrary code execution.
HIGH PowerShell Execution Policy Bypass -20 ▶
The skill instructs Windows users to bypass PowerShell execution policies, which is a dangerous security practice that disables built-in protections.
MEDIUM External Script Dependency Risk -15 ▶
While the skill itself doesn't exfiltrate data, it instructs users to execute external scripts that could potentially access and exfiltrate sensitive system data.
MEDIUM Promotes Dangerous Security Practices -40 ▶
The skill normalizes extremely dangerous installation practices that could lead to system compromise if the external repository is compromised or if users apply similar patterns elsewhere.
Should I install jatinbansal1998/zerodha-kite?
Oathe's verdict for jatinbansal1998/zerodha-kite is CAUTION with a trust score of 76/100. Recommendation: Review before install.