abel-invest

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to manage the Python environment, install dependencies, and execute the 'abel-edge' CLI for strategy evaluation.
  • Evidence in scripts/bootstrap_workspace.py shows the skill creates virtual environments and installs itself using pip.
  • Evidence in abel_invest/narrative_core/command_handlers/branch.py shows execution of the evaluation engine.
  • [EXTERNAL_DOWNLOADS]: The skill downloads 'sample strategies' (Python source code) from the vendor's official API (api.abel.ai). These files are stored in the local workspace to serve as reference material for the AI agent.
  • Implementation found in abel_invest/narrative_core/sample_strategy_context.py.
  • [DATA_EXFILTRATION]: The skill is designed to upload research 'artifacts' (ZIP files) and session data to the vendor's dashboard (api.abel.ai) for visualization and review. This is an intended feature of the 'Abel Invest' ecosystem.
  • Upload logic is located in abel_invest/narrative_core/dashboard.py and abel_invest/narrative_core/strategy_artifact_upload.py.
  • [DYNAMIC_EXECUTION]: The skill generates Python code from templates (abel_invest/narrative_core/contracts/templates.py) and executes it using the evaluation runtime. It also runs hardcoded Python snippets via python -c for environment reconciliation and diagnostics.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests 'sample strategies' and context from a remote API. While these are used as reference material, they represent a surface where external content can influence the agent's research directions.
  • [SAFE_PRACTICES]: The skill explicitly denylists sensitive files (e.g., .env, id_rsa, .key, .pem) from being included in exported research artifacts, reducing the risk of accidental credential exposure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 02:13 PM
Security Audit — agent-trust-hub — abel-invest