scorpion-strategy
Pass
Audited by Gen Agent Trust Hub on Mar 12, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
mcporterCLI tool to communicate with the Senpi MCP server. Command execution is handled viasubprocess.runusing list-based arguments without a shell, which is a secure practice that prevents command injection. - [EXTERNAL_DOWNLOADS]: The skill identifies dependencies on
mcporterandOpenClaw. References to external documentation and repositories point to the author's official GitHub organization (Senpi-ai), which is consistent with the skill's stated source. - [PROMPT_INJECTION]: The instructions provided in
README.mdandSKILL.mdare strictly operational, focusing on the 'Bootstrap Gate' logic and notification policies. There are no patterns suggesting attempts to bypass safety filters or override system-level instructions. - [DATA_EXFILTRATION]: Network operations are performed through the
mcportertool to interact with the designated trading infrastructure. No access to sensitive local files (such as SSH keys or environment secrets) was detected. - [PERSISTENCE]: The skill requests the creation of cron jobs for the scanner and stop-loss logic. This is the primary intended function of the skill for automated trading and is clearly documented in the architecture section.
Audit Metadata