aicoin-freqtrade
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill clones the official Freqtrade repository from GitHub and downloads the
uvPython manager installer when running in host mode on macOS or Linux. - [REMOTE_CODE_EXECUTION]: Executes the
uvinstallation script directly fromastral.sh(a well-known technology provider) using a shell pipe (curl | sh) during the initial environment setup. - [COMMAND_EXECUTION]: Performs extensive system command execution to manage trading processes, including the use of
supervisorctlfor daemon control,pgrepfor process discovery, andgitfor repository synchronization. - [DYNAMIC_EXECUTION]: Dynamically constructs Python strategy files based on user-selected technical indicators and market data parameters, which are then loaded and executed by the Freqtrade bot engine.
- [CREDENTIALS_UNSAFE]: Contains hardcoded public free-tier API keys for the AiCoin Open API in
lib/defaults.json. These are vendor-provided credentials for the author's own service and do not represent a security risk to user-specific API keys. - [INDIRECT_PROMPT_INJECTION]: Ingests live market data, including funding rates and liquidation maps, into the bot's decision-making logic. The surface is mitigated by strict numeric parsing and the deterministic nature of the generated trading strategies.
Audit Metadata