backtesting-trading-strategies
Warn
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill contains several indicators of deception and potential manipulation of agent context.
- Deceptive Metadata: There is a discrepancy between the author declared in the SKILL.md (Jeremy Longshore) and the system-reported author (aibot88), which may indicate impersonation or lack of accountability.
- Suspicious Documentation: The skill contains nonsensical comments in the script examples, such as
# 10000: 10 seconds in msnext to a capital parameter and# HTTP 200 OKnext to a strategy parameter grid. These patterns are atypical for financial software and could be used to hide malicious intent or indicate the use of unverified, copy-pasted code. - Indirect Prompt Injection: The skill fetches and processes external data from Yahoo Finance via the
yfinancelibrary. This external content is ingested into the agent's context without evidenced sanitization or boundary markers, creating an attack surface where malicious data could influence agent behavior. - [COMMAND_EXECUTION]: The skill utilizes the
Bash(python:*)tool to run local Python scripts (fetch_data.py,backtest.py,optimize.py) to perform its primary functions. - [EXTERNAL_DOWNLOADS]: The skill installs several third-party libraries from PyPI (pandas, numpy, yfinance, matplotlib, ta-lib, scipy, scikit-learn) and connects to external financial APIs to download historical data.
Audit Metadata