scorpion-strategy

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the mcporter CLI tool to communicate with the Senpi MCP server. Command execution is handled via subprocess.run using list-based arguments without a shell, which is a secure practice that prevents command injection.
  • [EXTERNAL_DOWNLOADS]: The skill identifies dependencies on mcporter and OpenClaw. References to external documentation and repositories point to the author's official GitHub organization (Senpi-ai), which is consistent with the skill's stated source.
  • [PROMPT_INJECTION]: The instructions provided in README.md and SKILL.md are strictly operational, focusing on the 'Bootstrap Gate' logic and notification policies. There are no patterns suggesting attempts to bypass safety filters or override system-level instructions.
  • [DATA_EXFILTRATION]: Network operations are performed through the mcporter tool to interact with the designated trading infrastructure. No access to sensitive local files (such as SSH keys or environment secrets) was detected.
  • [PERSISTENCE]: The skill requests the creation of cron jobs for the scanner and stop-loss logic. This is the primary intended function of the skill for automated trading and is clearly documented in the architecture section.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 06:26 PM