alphaear-signal-tracker

Pass

Audited by Gen Agent Trust Hub on May 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/utils/md_to_html.py invokes os.popen('date') to embed a generation timestamp into the footer of financial reports. This involves local shell execution; however, the command is static, benign, and restricted to retrieving the system date.
  • [EXTERNAL_DOWNLOADS]: The skill downloads pre-trained machine learning models and tokenizers from the HuggingFace Hub (NeoQuasar/Kronos-base) during initialization in scripts/utils/predictor/training.py and kline_generate.py. This is standard behavior for ML-integrated skills using well-known model registries.
  • [EXTERNAL_DOWNLOADS]: Web content extraction is performed via the Jina Reader API (r.jina.ai and s.jina.ai) in scripts/utils/content_extractor.py and scripts/utils/search_tools.py. These requests facilitate the researcher's ability to process real-time news into analysis materials using a well-known technology provider.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves financial market data from akshare and news feeds from newsnow.busiyi.world. These operations are consistent with the skill's primary purpose and target established financial data providers.
  • [SAFE]: Static analysis alerts for eval() in the prediction scripts are false positives. The calls identified are for the PyTorch model.eval() method, which transitions neural networks into inference mode, rather than the dangerous Python eval() built-in function.
Audit Metadata
Risk Level
SAFE
Analyzed
May 7, 2026, 05:57 PM