alphagbm-etf-strategy
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bundled Python runner script (
scripts/run.py) to interface with AlphaGBM services. This is the intended entry point for all ETF analysis tasks. - [EXTERNAL_DOWNLOADS]: The runner script communicates with the vendor's production and staging API endpoints (
alphagbm.comandalphagbm.zeabur.app) to fetch financial metrics, research reports, and news catalogue data. - [DATA_EXFILTRATION]: The skill transmits the user's
ALPHAGBM_API_KEYfrom the environment to the vendor's API for authentication. It also allows uploading local transaction files for 'smart money' analysis to the vendor's platform, which is a core feature of the tool. - [DYNAMIC_EXECUTION]: The main runner script dynamically loads a bundled utility module (
scripts/review_engine.py) using Python'simportlibto perform offline snapshot comparisons. The loading path is strictly local to the skill directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes research articles and API responses which are considered untrusted external data.
- Ingestion points: Financial research and news data retrieved from AlphaGBM API endpoints.
- Boundary markers: The
references/access.mdfile provides explicit instructions to the agent to treat all retrieved API strings and reports as untrusted data and to ignore any instructions embedded within them. - Capability inventory: The skill has network access, local file reading capabilities (for specific data files), and the ability to execute its bundled scripts.
- Sanitization: The runner script implements strict JSON parsing and schema validation to ensure response integrity.
Audit Metadata