alpaca-cli
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install the Alpaca CLI tool directly from the vendor's official GitHub repository using the
go installcommand. This is the standard distribution method for this tool. - [COMMAND_EXECUTION]: The skill enables the agent to execute a variety of commands for stock and cryptocurrency trading, market data retrieval, and account management through the
alpacabinary. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes user-provided parameters, such as symbols and order quantities, to execute financial transactions.
- Ingestion points: Processes user-supplied data for trading order parameters (e.g.,
--symbol,--qty) in the instructions. - Boundary markers: Relies on command-line flag structures; however, it does not implement explicit delimiters to separate untrusted text inputs.
- Capability inventory: Performs financial transactions (order submission), account data retrieval, and market data queries via the Alpaca CLI.
- Sanitization: The skill includes robust defensive guidance, including warnings against automated live trading without confirmation, the use of
--dry-runfor verification, and the requirement of--client-order-idfor idempotency.
Audit Metadata