ea-backtest-analyst
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and parse untrusted external data, specifically MetaTrader 5 Strategy Tester reports in HTML, XML, or CSV formats. This creates a surface for indirect prompt injection if those reports contain malicious instructions meant to influence the agent's behavior during analysis.
- Ingestion points: The skill explicitly requests and processes MT5 backtest reports, trade histories, and optimization grids (SKILL.md).
- Boundary markers: The skill uses 'Dynamic Execution Zone' markers and clear section headers to separate instructions from data, but it lacks specific instructions to the agent to ignore any natural language commands found within the processed reports.
- Capability inventory: The skill's capabilities are focused on data parsing, statistical calculation, and report generation. There are no indications of dangerous capabilities such as arbitrary shell execution, network exfiltration, or file-system writing tools.
- Sanitization: There is no explicit mention of sanitizing or escaping the content of the reports before they are processed by the agent.
Audit Metadata