backtrader
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external financial data from CSV files, representing an attack surface for indirect prompt injection. 1. Ingestion points: Data ingestion is shown in
SKILL.md(GenericCSVData) andreferences/api_guide.md(pd.read_csv). 2. Boundary markers: There are no explicit delimiters or instructions to ignore embedded content for the input data. 3. Capability inventory: The backtesting scripts (scripts/backtest_strategy.py,scripts/bracket_orders.py) perform local calculations, print logs, and generate plots; they do not possess network or arbitrary command execution capabilities. 4. Sanitization: Input data is processed using standard parsers without additional validation. - [EXTERNAL_DOWNLOADS]: The skill recommends installing several Python packages for its operation. 1. Evidence:
SKILL.mdcontains the commanduv pip install backtrader pandas numpy matplotlib. 2. Details: These are standard, well-known libraries, but the installation command does not include specific version pinning.
Audit Metadata