vectorbt
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious behavior or attack patterns were identified. The skill implements legitimate quantitative finance functionality.
- [EXTERNAL_DOWNLOADS]: The skill downloads historical market data from Yahoo Finance via the
vbt.YFData.downloadmethod. Yahoo Finance is a well-known and trusted service for financial information. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process OHLCV (Open, High, Low, Close, Volume) data from external CSV files and APIs.
- Ingestion points: Data is loaded via
pd.read_csvand the Yahoo Finance API inSKILL.mdandreferences/api_guide.md. - Boundary markers: Absent, as the tool expects structured numerical data for mathematical processing.
- Capability inventory: The skill performs array-based calculations for trading metrics and generates visualizations; it does not contain subprocess calls, shell execution, arbitrary file writes, or network exfiltration logic.
- Sanitization: None, which is standard for numeric backtesting libraries that do not execute the content of the data ingested.
Audit Metadata