backtrader

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external financial data from CSV files, representing an attack surface for indirect prompt injection. 1. Ingestion points: Data ingestion is shown in SKILL.md (GenericCSVData) and references/api_guide.md (pd.read_csv). 2. Boundary markers: There are no explicit delimiters or instructions to ignore embedded content for the input data. 3. Capability inventory: The backtesting scripts (scripts/backtest_strategy.py, scripts/bracket_orders.py) perform local calculations, print logs, and generate plots; they do not possess network or arbitrary command execution capabilities. 4. Sanitization: Input data is processed using standard parsers without additional validation.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing several Python packages for its operation. 1. Evidence: SKILL.md contains the command uv pip install backtrader pandas numpy matplotlib. 2. Details: These are standard, well-known libraries, but the installation command does not include specific version pinning.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:54 PM