backtesting-trading-strategies
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches historical market data from well-known and legitimate services, including the CoinGecko API (api.coingecko.com) and Yahoo Finance (via the yfinance library). These are documented, industry-standard sources for financial data and do not represent a security risk.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted historical price data from external APIs and local CSV files. While this constitutes a potential ingestion surface for indirect prompt injection, the data is strictly numerical (price, volume, dates) and is used exclusively for mathematical backtesting calculations and equity curve visualization. This data is not used to construct instructions for the agent. (Ingestion points: scripts/fetch_data.py, scripts/backtest.py; Boundary markers: None specific; Capability inventory: Numerical analysis and plotting via Python; Sanitization: Standard CSV and JSON parsing for numerical values).
- [DYNAMIC_EXECUTION]: The project scripts utilize standard Python patterns for local module management, such as adjusting the system path to load adjacent logic for strategies and metrics within the skill's own directory. This is a common and safe practice for organizing local code and does not involve the dynamic execution of untrusted or remote code.
Audit Metadata