github analyzed 33e0e1e

koreainvestment/open-trading-api

github

Korea Investment & Securities Open API Github

maintainer: koreainvestment
license: —
first seen: 2026-06-01
last seen: 2026-06-04
releases · 30d: 0
short id

Drift inferred · capture-to-capture

HIGH 2026-06-14 code analysis flagged committed secret, dynamic code execution ×13 in koreainvestment/open-trading-api

capabilities0 tools

transport stdio · streamable-http · http · sse counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signalsgithub-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 33e0e1e · analyzer v17 · 1h ago

danger signals15

dynamic code executionunsafe yaml.load()koreainvestment-open-trading-api-33e0e1e/backtester/kis_auth.py:52_cfg = yaml.load(f, Loader=yaml.FullLoader)
dynamic code executionunsafe yaml.load()koreainvestment-open-trading-api-33e0e1e/examples_llm/kis_auth.py:50_cfg = yaml.load(f, Loader=yaml.FullLoader)
dynamic code executionunsafe yaml.load()koreainvestment-open-trading-api-33e0e1e/examples_user/kis_auth.py:50_cfg = yaml.load(f, Loader=yaml.FullLoader)
dynamic code executionunsafe yaml.load()koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_auth.py:48_cfg = yaml.load(f, Loader=yaml.FullLoader)
dynamic code executioneval()/exec()koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_domstk_ws.py:62def eval(self):
dynamic code executioneval()/exec()koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_ovrseafuopt_ws.py:62def eval(self):
dynamic code executioneval()/exec()koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_ovrseastk_ws.py:62def eval(self):
dynamic code executionunsafe yaml.load()koreainvestment-open-trading-api-33e0e1e/legacy/rest/get_interest_stocks_price.py:14_cfg = yaml.load(f, Loader=yaml.FullLoader)
dynamic code executionunsafe yaml.load()koreainvestment-open-trading-api-33e0e1e/legacy/rest/get_ovsfut_chart_price.py:15_cfg = yaml.load(f, Loader=yaml.FullLoader)
dynamic code executionunsafe yaml.load()koreainvestment-open-trading-api-33e0e1e/legacy/rest/get_ovsstk_chart_price.py:18_cfg = yaml.load(f, Loader=yaml.FullLoader)
dynamic code executionunsafe yaml.load()koreainvestment-open-trading-api-33e0e1e/legacy/rest/kis_api.py:19_cfg = yaml.load(f, Loader=yaml.FullLoader)
dynamic code executionunsafe yaml.load()koreainvestment-open-trading-api-33e0e1e/legacy/rest/kis_auth.py:35_cfg = yaml.load(f, Loader=yaml.FullLoader)
dynamic code executionunsafe yaml.load()koreainvestment-open-trading-api-33e0e1e/strategy_builder/kis_auth.py:52_cfg = yaml.load(f, Loader=yaml.FullLoader)
committed secretcommitted .envkoreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/.env.live:1env file shipped with populated values
credential in logscredential in logkoreainvestment-open-trading-api-33e0e1e/legacy/rest/get_ovsstk_chart_price.py:27print(APP_KEY, APP_SECRET, ACCESS_TOKEN, HTS_ID)

code evidencevHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

filesystem 54

fs koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/module/plugin/kis.py :147 with open(kis_config_path, 'w', encoding='utf-8') as f:
fs koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/module/plugin/master_file.py :3 import shutil
fs koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/tools/base.py :6 import shutil
fs koreainvestment-open-trading-api-33e0e1e/backtester/backend/main.py :12 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/backend/routes/backtest.py :9 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/backend/routes/files.py :7 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/backend/routes/symbols.py :11 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/backend/state.py :55 with open(path, encoding="utf-8") as f:
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_auth.py :47 f = open(token_tmp, "w+")
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/client.py :9 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/codegen/generator.py :11 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/core/indicator.py :1103 def open() -> Indicator:
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/file/loader.py :10 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/file/saver.py :10 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/file/templates/__init__.py :6 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/lean/data_converter.py :7 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/lean/executor.py :11 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/lean/project_manager.py :10 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/models/result.py :5 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/providers/kis/auth.py :10 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/providers/kis/brokerage.py :336 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/providers/kis/websocket.py :33 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/report/generator.py :8 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/report/portfolio_report.py :11 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/tools/backtest.py :17 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/tools/report.py :12 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/backtester/scripts/download_master.py :15 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/examples_llm/kis_auth.py :45 f = open(token_tmp, "w+")
fs koreainvestment-open-trading-api-33e0e1e/examples_user/kis_auth.py :45 f = open(token_tmp, "w+")
fs koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_auth.py :43 f = open(token_tmp, "w+")
fs koreainvestment-open-trading-api-33e0e1e/legacy/rest/get_interest_stocks_price.py :13 with open('config.yaml', encoding='UTF-8') as f:
fs koreainvestment-open-trading-api-33e0e1e/legacy/rest/get_ovsfut_chart_price.py :14 with open('config.yaml', encoding='UTF-8') as f:
fs koreainvestment-open-trading-api-33e0e1e/legacy/rest/get_ovsstk_chart_price.py :17 with open('config.yaml', encoding='UTF-8') as f:
fs koreainvestment-open-trading-api-33e0e1e/legacy/rest/kis_api.py :18 with open(r'kisdev_vi.yaml', encoding='UTF-8') as f:
fs koreainvestment-open-trading-api-33e0e1e/legacy/rest/kis_auth.py :30 f = open(token_tmp, "w+")
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_bond_code.py :27 with open(file_path, mode="r", encoding="cp949") as f:
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_cme_future_code.py :28 with open(file_name, mode="r", encoding="cp949") as f:
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_commodity_future_code.py :28 wf1 = open(tmp_fil1, mode="w")
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_elw_code.py :27 with open(file_path, mode="r", encoding="cp949") as f:
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_eurex_option_code.py :28 wf1 = open(tmp_fil1, mode="w")
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/kis_konex_code_mst.py :27 with open(file_path, mode="r", encoding="cp949") as f:
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/kis_kosdaq_code_mst.py :28 os.remove("kosdaq_code.zip")
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/kis_kospi_code_mst.py :27 os.remove("kospi_code.zip")
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/member_code.py :22 with open(file_path, mode="r", encoding="cp949") as f:
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/overseas_future_code.py :29 with open(file_name, mode="r", encoding="cp949") as f:
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/overseas_index_code.py :34 wf1 = open(tmp_fil1, mode="w")
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/sector_code.py :23 with open(file_name, mode="r", encoding="cp949") as f:
fs koreainvestment-open-trading-api-33e0e1e/stocks_info/theme_code.py :23 with open(file_name, mode="r", encoding="cp949") as f:
fs koreainvestment-open-trading-api-33e0e1e/strategy_builder/backend/routers/strategy.py :134 with open(filepath, 'r', encoding='utf-8') as f:
fs koreainvestment-open-trading-api-33e0e1e/strategy_builder/backend/routers/symbols.py :11 from pathlib import Path
fs koreainvestment-open-trading-api-33e0e1e/strategy_builder/backend/state.py :55 with open(path, encoding="utf-8") as f:
fs koreainvestment-open-trading-api-33e0e1e/strategy_builder/kis_auth.py :47 f = open(token_tmp, "w+")
fs koreainvestment-open-trading-api-33e0e1e/strategy_builder/strategy_core/dsl/codegen.py :679 with open(file_path, "w", encoding="utf-8") as f:
fs koreainvestment-open-trading-api-33e0e1e/strategy_builder/strategy_core/executor.py :18 from pathlib import Path

shell / exec 19

shell koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/tools/base.py :7 import subprocess
shell koreainvestment-open-trading-api-33e0e1e/backtester/kis_auth.py :34 return os.system("cls" if os.name in ("nt", "dos") else "clear")
shell koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/lean/executor.py :8 import subprocess
shell koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/tools/report.py :136 import subprocess, sys
shell koreainvestment-open-trading-api-33e0e1e/examples_llm/kis_auth.py :32 clearConsole = lambda: os.system("cls" if os.name in ("nt", "dos") else "clear")
shell koreainvestment-open-trading-api-33e0e1e/examples_user/kis_auth.py :32 clearConsole = lambda: os.system("cls" if os.name in ("nt", "dos") else "clear")
shell koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_auth.py :32 clearConsole = lambda: os.system('cls' if os.name in ('nt', 'dos') else 'clear')
shell koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_domstk_ws.py :27 os.system('python3 -m pip3 install websocket-client')
shell koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_ovrseafuopt_ws.py :27 os.system('python3 -m pip3 install websocket-client')
shell koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_ovrseastk_ws.py :27 os.system('python3 -m pip3 install websocket-client')
shell koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ops_ws_sample.py :13 clearConsole = lambda: os.system('cls' if os.name in ('nt', 'dos') else 'clear')
shell koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_commodity_future.py :16 clearConsole = lambda: os.system('cls' if os.name in ('nt', 'dos') else 'clear')
shell koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_domestic+overseas_stock.py :16 clearConsole = lambda: os.system('cls' if os.name in ('nt', 'dos') else 'clear')
shell koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_domestic_future.py :16 clearConsole = lambda: os.system('cls' if os.name in ('nt', 'dos') else 'clear')
shell koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_domestic_overseas_all.py :16 clearConsole = lambda: os.system('cls' if os.name in ('nt', 'dos') else 'clear')
shell koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_domestic_stock.py :16 clearConsole = lambda: os.system('cls' if os.name in ('nt', 'dos') else 'clear')
shell koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_overseas_future.py :16 clearConsole = lambda: os.system('cls' if os.name in ('nt', 'dos') else 'clear')
shell koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_overseas_stock.py :16 clearConsole = lambda: os.system('cls' if os.name in ('nt', 'dos') else 'clear')
shell koreainvestment-open-trading-api-33e0e1e/strategy_builder/kis_auth.py :34 return os.system("cls" if os.name in ("nt", "dos") else "clear")

network 55

net koreainvestment-open-trading-api-33e0e1e/MCP/KIS Code Assistant MCP/server.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/module/plugin/kis.py :3 import requests
net koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/module/plugin/master_file.py :4 import requests
net koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/tools/base.py :8 import requests
net koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/tools/domestic_futureoption.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/backtester/backend/routes/symbols.py :14 import httpx
net koreainvestment-open-trading-api-33e0e1e/backtester/kis_auth.py :20 import requests
net koreainvestment-open-trading-api-33e0e1e/backtester/kis_backtest/providers/kis/websocket.py :37 import requests
net koreainvestment-open-trading-api-33e0e1e/backtester/scripts/download_master.py :16 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/examples_llm/auth/auth_token/auth_token.py :14 import requests
net koreainvestment-open-trading-api-33e0e1e/examples_llm/auth/auth_ws_token/auth_ws_token.py :15 import requests
net koreainvestment-open-trading-api-33e0e1e/examples_llm/kis_auth.py :20 import requests
net koreainvestment-open-trading-api-33e0e1e/examples_user/auth/auth_functions.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/examples_user/kis_auth.py :20 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_auth.py :15 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_domfuopt.py :10 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_domstk.py :11 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_domstk_ws.py :9 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_ovrseafuopt.py :10 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_ovrseafuopt_ws.py :9 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_ovrseastk.py :10 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/Sample01/kis_ovrseastk_ws.py :9 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/rest/current_price_samle.py :1 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/rest/get_interest_stocks_price.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/rest/get_ovsfut_chart_price.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/rest/get_ovsstk_chart_price.py :11 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/rest/kis_api.py :10 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/rest/kis_auth.py :12 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/multi_processing_sample_ws.py :8 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ops_ws_sample.py :4 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_commodity_future.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_domestic+overseas_stock.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_domestic_future.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_domestic_overseas_all.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_domestic_stock.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_overseas_future.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/legacy/websocket/python/ws_overseas_stock.py :7 import requests
net koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_bond_code.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_cme_future_code.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_commodity_future_code.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_elw_code.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_eurex_option_code.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_index_future_code.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/domestic_stock_future_code.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/kis_konex_code_mst.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/kis_kosdaq_code_mst.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/kis_kospi_code_mst.py :3 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/member_code.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/overseas_future_code.py :4 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/overseas_index_code.py :9 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/overseas_stock_code.py :19 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/sector_code.py :2 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/stocks_info/theme_code.py :2 import urllib.request
net koreainvestment-open-trading-api-33e0e1e/strategy_builder/backend/routers/symbols.py :14 import httpx
net koreainvestment-open-trading-api-33e0e1e/strategy_builder/kis_auth.py :20 import requests

database 11

db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/model/auth.py :1 from sqlalchemy import Column, Integer, String
db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/model/base.py :1 from sqlalchemy.orm import declarative_base
db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/model/domestic_bond.py :1 from sqlalchemy import Column, Integer, String
db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/model/domestic_futureoption.py :1 from sqlalchemy import Column, Integer, String
db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/model/domestic_stock.py :1 from sqlalchemy import Column, Integer, String
db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/model/elw.py :1 from sqlalchemy import Column, Integer, String
db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/model/etfetn.py :1 from sqlalchemy import Column, Integer, String
db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/model/overseas_futureoption.py :1 from sqlalchemy import Column, Integer, String
db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/model/overseas_stock.py :1 from sqlalchemy import Column, Integer, String
db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/model/updated.py :1 from sqlalchemy import Column, Integer, String, DateTime
db koreainvestment-open-trading-api-33e0e1e/MCP/Kis Trading MCP/module/plugin/database.py :2 from sqlalchemy import create_engine, Engine

tool registrations 11

list_presets_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :69
get_preset_yaml_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :75
validate_yaml_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :89
list_indicators_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :99
run_backtest_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :107
run_preset_backtest_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :146
get_backtest_result_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :185
retry_backtest_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :211
get_report_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :230
run_batch_backtest_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :246
optimize_strategy_tool koreainvestment-open-trading-api-33e0e1e/backtester/kis_mcp/server.py :284

declared dependencies 7

pandas@>=2.3.1
pycryptodome@>=3.23.0
pyqt6@>=6.9.1
pyside6@>=6.9.1
pyyaml@>=6.0.2
requests@>=2.32.4
websockets@>=15.0.1