alphagbm-momentum-following
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs trend analysis by communicating exclusively with official AlphaGBM domains and verified deployment subdomains. The Python runner implements an explicit hostname allowlist and disables HTTP redirects to prevent server-side request forgery (SSRF).
- [SAFE]: Secret management is handled correctly. The instructions and implementation require the
ALPHAGBM_API_KEYto be configured in the system environment, strictly prohibiting its inclusion in chat prompts, command arguments, or browser storage. - [SAFE]: The skill manages untrusted data—including API responses, transaction records, and workflow snapshots—by treating them as non-executable evidence. The implementation uses strict JSON parsing with finite-value constraints and structural validation to mitigate indirect prompt injection risks.
- [SAFE]: Dynamic code operations are limited to the modular loading of the bundled review engine using static local paths. This internal organization is secure and does not involve the execution of remote or user-supplied code.
Audit Metadata