alpaca-trading-backtest
Warn
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the Alpaca CLI using 'go install' from the vendor's GitHub repository or via Homebrew. This is the primary tool used for market data acquisition.
- [COMMAND_EXECUTION]: The skill requires a high level of environment permissions (documented as 'all' or equivalent) to allow the Alpaca CLI to access local authentication profiles and write artifacts to the filesystem.
- [REMOTE_CODE_EXECUTION]: A central component of the skill's workflow is the agent's ability to translate user-defined trading strategies into a local Python script ('run.py') which is subsequently executed to perform the backtest simulation.
- [COMMAND_EXECUTION]: The agent executes various shell commands including 'alpaca doctor' for connectivity checks and 'alpaca data' for fetching historical price bars, quotes, and corporate actions.
- [DATA_EXFILTRATION]: The skill manages sensitive API credentials (ALPACA_API_KEY and ALPACA_SECRET_KEY) used for authentication with the Alpaca platform. The instructions include explicit safeguards to prevent the agent from logging or exposing these secrets in reports or shell history.
Audit Metadata