backtest-expert
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Python script (
skills/backtest-expert/scripts/evaluate_backtest.py) to perform quantitative analysis on backtest data provided by the user. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data (trading metrics like win rate, drawdown, and trade count) by passing them as arguments to its evaluation script. This represents an ingestion surface for untrusted data.
- Ingestion points: Metric values supplied by the user are interpolated into a shell command in
SKILL.md. - Boundary markers: Not present; the values are passed directly as command-line arguments.
- Capability inventory: The skill executes a local Python script and writes generated reports to the
reports/directory. - Sanitization: Not explicitly defined in the markdown, though the expected inputs are specific numeric values for a structured scoring engine.
Audit Metadata