alphagbm-dca-plan
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches financial data, market insights, and research reports from official AlphaGBM domains, including alphagbm.com and its associated staging and deployment environments. These network operations are limited to the vendor's infrastructure to fulfill the skill's primary research functions.
- [COMMAND_EXECUTION]: Executes a bundled Python script (scripts/run.py) to process user requests, perform API calls, and format financial calculations. The execution is scoped to the skill's own logic and requires user approval for any actions that consume account allowance.
- [DATA_EXFILTRATION]: Transmits user-provided ticker symbols, contribution amounts, and transaction history to AlphaGBM servers for analysis. Sensitive credentials like the ALPHAGBM_API_KEY are strictly managed through environment variables and are not passed as command-line arguments or stored in plaintext within the skill files.
- [DYNAMIC_EXECUTION]: The runner script dynamically imports the bundled review_engine.py module at runtime to handle comparison tasks for investment snapshots. This dynamic loading is restricted to local files within the skill package.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from API responses and research articles. It includes explicit defensive instructions to treat all retrieved content as untrusted data rather than instructions, preventing the agent from executing embedded commands or revealing sensitive configuration.
Audit Metadata