trading-bot
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFENO_CODECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of Python's
subprocessmodule to orchestrate thesnandledgerCLI tools. The provided code patterns (e.g., inreferences/implementation-patterns.md) correctly use list-based arguments for subprocess calls, which mitigates shell injection risks. - [EXTERNAL_DOWNLOADS]: The bot architecture is designed to ingest live trading signals from a remote NATS stream via the
sn signalscommand. This external connection is central to the bot's functionality and is documented as a core architectural component. - [PROMPT_INJECTION]: The skill describes a data ingestion surface for processing external market signals. ● Ingestion points: The bot reads signal data from the
sn signalssubprocess stdout. ● Boundary markers: Data is processed as structured JSON lines. ● Capability inventory: The bot executes financial transactions and position queries through theledgerCLI. ● Sanitization: The patterns demonstrate parsing input as JSON and validating specific fields, such as numerical bounds checks for stop-loss/take-profit levels and prefix matching for strategy verification. - [NO_CODE]: This skill is primarily documentation and reference-based; it does not include executable script files or binaries within the package, relying instead on the user to implement the described patterns.
Audit Metadata