stock-trading

Pass

Audited by Gen Agent Trust Hub on Mar 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to external APIs for real-time market data. It connects to Sina Finance via hq.sinajs.cn and to an OpenCTC simulation gateway at 121.37.80.177. These are established services for financial data and trading simulation.
  • [PROMPT_INJECTION]: The skill's trading strategy involves ingesting data from web searches, which could contain adversarial instructions designed to influence the agent's behavior.
  • Ingestion points: Untrusted data enters the context via search results as specified in the workflow instructions in strategy.md.
  • Boundary markers: The instructions include a clear safety rule requiring explicit user confirmation before any transaction is executed, which serves to mitigate the risk of automated unauthorized actions.
  • Capability inventory: The scripts perform file writes to a local state.json for portfolio tracking and use the urllib and openctp_ctp libraries for network-based data retrieval across all scripts.
  • Sanitization: The skill relies on agent reasoning and the mandatory confirmation workflow rather than automated input filtering or escaping of the search results.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 21, 2026, 12:07 PM