senpi-trading-runtime
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: Utilizes the
openclawCLI and RPC gateway calls to perform administrative tasks such as installing runtimes, deleting configurations, and inspecting position states. These operations are standard for a trading infrastructure management tool. - [PROMPT_INJECTION]: Implements a strict "MCP-first" guardrail that requires the agent to validate strategy wallets through specific tool calls before performing sensitive operations, which helps prevent the use of unauthorized or incorrect wallet addresses.
- [SAFE]: Sensitive data like wallet addresses, API keys, and notification tokens are managed through environment variables (
${WALLET_ADDRESS},${SENPI_API_KEY}) and local config files, avoiding the use of hardcoded credentials. - [SAFE]: All external references and templates are sourced from the developer's official repository and documentation, posing no risk to the integrity of the skill's execution environment.
Audit Metadata