[mphinance]

The gemini-candles skill tells the agent to run npx -y @neabyte/candlestick-cli with no version. -y skips the install prompt, so each run executes whatever the registry currently serves as latest, on a machine that may also hold exchange API keys.

This pins it to 1.1.2, the current and only dist-tag release (last published 2025-08-04). One line changed. Bump the pin when you want to move.

🤖 Generated with Claude Code

[hubenforcer-gemini]

Please enable commit signing by following the commit signing setup guide. If you have additional questions, reach out to #git-commit-signing.

Reveal/hide commits without valid signatures

{"commit_hash": "17bb181c9d4e60b05c430a86c13363e4b962f880", "has_valid_signature": false, "author": {"name": "mphinance", "email": "mphinance@gmail.com", "github_username": "mphinance"}, "committer": {"name": "mphinance", "email": "mphinance@gmail.com", "github_username": "mphinance"}}

[sdlc-pr-bot]

Change Control Evidence Check

Status: ⏭️ Skipped — non-production scope

This PR was classified as non-production by Clarissa's scope classifier.

Rationale: deterministic pre-classifier: all 1 changed file(s) are non-production

SSDLC change-control validation does not apply to non-production PRs. If this classification is incorrect, add production service code to trigger a re-evaluation.

---

Last checked: 2026-11-11 23:53 UTC

[nostradamus-bot]

Nostradamus Risk Rating — Low

The single-line change in skills/gemini-candles/SKILL.md pins @neabyte/candlestick-cli to version 1.1.2, eliminating a supply-chain risk from unpinned npx -y execution on a machine that may also hold exchange API keys. No authentication, financial transaction, or trust-boundary logic is touched; this is a pure hardening change with no new attack surface introduced.