aicoin-freqtrade

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill clones the official Freqtrade repository from GitHub and downloads the uv Python manager installer when running in host mode on macOS or Linux.
  • [REMOTE_CODE_EXECUTION]: Executes the uv installation script directly from astral.sh (a well-known technology provider) using a shell pipe (curl | sh) during the initial environment setup.
  • [COMMAND_EXECUTION]: Performs extensive system command execution to manage trading processes, including the use of supervisorctl for daemon control, pgrep for process discovery, and git for repository synchronization.
  • [DYNAMIC_EXECUTION]: Dynamically constructs Python strategy files based on user-selected technical indicators and market data parameters, which are then loaded and executed by the Freqtrade bot engine.
  • [CREDENTIALS_UNSAFE]: Contains hardcoded public free-tier API keys for the AiCoin Open API in lib/defaults.json. These are vendor-provided credentials for the author's own service and do not represent a security risk to user-specific API keys.
  • [INDIRECT_PROMPT_INJECTION]: Ingests live market data, including funding rates and liquidation maps, into the bot's decision-making logic. The surface is mitigated by strict numeric parsing and the deterministic nature of the generated trading strategies.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 05:16 AM