alphagbm-bps-backtest
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and display natural language summary text (in both English and Chinese) returned from the AlphaGBM API. This represents an attack surface where a compromised or malicious API could return instructions intended to influence the agent's downstream behavior.
- Ingestion points: The
summary.enandsummary.zhfields in the API response withinSKILL.md. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined for the returned text.
- Capability inventory: The skill does not request access to any dangerous tools or provide executable scripts that could be leveraged by an injection.
- Sanitization: No sanitization or validation logic is specified for the external content.
- [NO_CODE]: The skill does not include any executable scripts, binaries, or package configuration files. It consists entirely of markdown documentation describing parameters and API interaction schemas.
Audit Metadata