alphaear-signal-tracker
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/utils/md_to_html.pyinvokesos.popen('date')to embed a generation timestamp into the footer of financial reports. This involves local shell execution; however, the command is static, benign, and restricted to retrieving the system date. - [EXTERNAL_DOWNLOADS]: The skill downloads pre-trained machine learning models and tokenizers from the HuggingFace Hub (
NeoQuasar/Kronos-base) during initialization inscripts/utils/predictor/training.pyandkline_generate.py. This is standard behavior for ML-integrated skills using well-known model registries. - [EXTERNAL_DOWNLOADS]: Web content extraction is performed via the Jina Reader API (
r.jina.aiands.jina.ai) inscripts/utils/content_extractor.pyandscripts/utils/search_tools.py. These requests facilitate the researcher's ability to process real-time news into analysis materials using a well-known technology provider. - [EXTERNAL_DOWNLOADS]: The skill retrieves financial market data from
akshareand news feeds fromnewsnow.busiyi.world. These operations are consistent with the skill's primary purpose and target established financial data providers. - [SAFE]: Static analysis alerts for
eval()in the prediction scripts are false positives. The calls identified are for the PyTorchmodel.eval()method, which transitions neural networks into inference mode, rather than the dangerous Pythoneval()built-in function.
Audit Metadata