alpaca-trading-paper-trading-mcp
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
jqor apython3one-liner to verify the execution environment. - Evidence: Instructions in
SKILL.md(Step 12) direct the agent to runjq -r '.mcpServers | keys[]' ~/.cursor/mcp.jsonand a Python one-liner to parse configuration values. - [DATA_EXPOSURE]: The skill requires access to a sensitive configuration file that contains API keys and secret keys.
- Evidence: The workflow (Step 12) instructs the agent to read
~/.cursor/mcp.json. While the skill includes specific instructions to extract only theALPACA_PAPER_TRADEflag and explicitly warns against reading the whole file, the agent still performs file operations on a high-value target containing credentials. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process trading signals from various external sources, creating an attack surface for indirect prompt injection.
- Ingestion points: Trading signals originating from "backtest results", "scheduled triggers", or "conversational requests" (SKILL.md, Phase 1).
- Boundary markers: The skill employs robust boundaries including explicit strategy restatement (Step 2), mandatory user confirmation (Step 3), and order preview tables (Step 16) to mitigate accidental obedience to embedded instructions.
- Capability inventory: The agent can execute trades (
place_stock_order, etc.), modify orders, liquidate positions (close_all_positions), and exercise options via the Alpaca MCP server. - Sanitization: The skill relies on natural language confirmation and strategy restatement rather than programmatic sanitization or schema-based isolation for the input signals.
Audit Metadata