cobra-strategy
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
cobra_config.pyutilizessubprocess.runto call themcporterCLI tool. This is a standard mechanism within the Senpi ecosystem for retrieving market data and executing trade instructions via the Model Context Protocol (MCP). - [EXTERNAL_DOWNLOADS]: The documentation references official GitHub repositories and specification files hosted under the
Senpi-aiorganization. These are recognized as trusted vendor resources. - [DATA_EXPOSURE]: The skill retrieves account identifiers and wallet addresses from environment variables (
COBRA_WALLET,COBRA_STRATEGY_ID). This is necessary for legitimate trading operations and does not involve hardcoded secrets. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted market data (asset names, candle data) from external exchanges via the MCP.
- Ingestion points:
market_get_asset_data,leaderboard_get_markets, andmarket_list_instrumentscalls incobra-scanner.py. - Boundary markers: None present in the standard output passed to the agent.
- Capability inventory: Subprocess execution (
mcporter) and local state file writes (scripts/cobra_config.py). - Sanitization: Data is parsed as JSON, but specific string fields from market data are interpolated into output messages without explicit filtering.
Audit Metadata