skills/spot-canvas/sn/trading-bot/Gen Agent Trust Hub

trading-bot

Pass

Audited by Gen Agent Trust Hub on Mar 1, 2026

Risk Level: SAFENO_CODECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of Python's subprocess module to orchestrate the sn and ledger CLI tools. The provided code patterns (e.g., in references/implementation-patterns.md) correctly use list-based arguments for subprocess calls, which mitigates shell injection risks.
  • [EXTERNAL_DOWNLOADS]: The bot architecture is designed to ingest live trading signals from a remote NATS stream via the sn signals command. This external connection is central to the bot's functionality and is documented as a core architectural component.
  • [PROMPT_INJECTION]: The skill describes a data ingestion surface for processing external market signals. ● Ingestion points: The bot reads signal data from the sn signals subprocess stdout. ● Boundary markers: Data is processed as structured JSON lines. ● Capability inventory: The bot executes financial transactions and position queries through the ledger CLI. ● Sanitization: The patterns demonstrate parsing input as JSON and validating specific fields, such as numerical bounds checks for stop-loss/take-profit levels and prefix matching for strategy verification.
  • [NO_CODE]: This skill is primarily documentation and reference-based; it does not include executable script files or binaries within the package, relying instead on the user to implement the described patterns.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 1, 2026, 08:01 PM