vectorbt

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: No malicious behavior or attack patterns were identified. The skill implements legitimate quantitative finance functionality.
  • [EXTERNAL_DOWNLOADS]: The skill downloads historical market data from Yahoo Finance via the vbt.YFData.download method. Yahoo Finance is a well-known and trusted service for financial information.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process OHLCV (Open, High, Low, Close, Volume) data from external CSV files and APIs.
  • Ingestion points: Data is loaded via pd.read_csv and the Yahoo Finance API in SKILL.md and references/api_guide.md.
  • Boundary markers: Absent, as the tool expects structured numerical data for mathematical processing.
  • Capability inventory: The skill performs array-based calculations for trading metrics and generates visualizations; it does not contain subprocess calls, shell execution, arbitrary file writes, or network exfiltration logic.
  • Sanitization: None, which is standard for numeric backtesting libraries that do not execute the content of the data ingested.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:54 PM