option-flow
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches public option chain data from Yahoo Finance using the
yfinancelibrary. This is a standard and expected behavior for the skill's purpose of financial regime analysis. - [COMMAND_EXECUTION]: The skill includes a shell script (
tests/test_gex_scan.sh) and uses inline Python execution within the script for regression testing. These operations are performed on local static fixtures and do not involve untrusted input or remote code. - [DATA_EXFILTRATION]: No evidence of unauthorized data access or exfiltration. The skill processes public market data or user-supplied JSON snapshots, focusing on mathematical calculations for GEX and noise bands.
- [PROMPT_INJECTION]: The instructions in
SKILL.mdare descriptive and provide a clear framework for the agent's behavior. They include safety disclaimers and do not contain patterns aimed at bypassing AI guardrails or extracting system prompts. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data from option chains. Security risk is minimized by strict type-casting of ingested data (e.g., converting strikes and open interest to floats/ints) before processing, which prevents the data from being interpreted as instructions.
- [SAFE]: The skill implements a 'liquidity gate' that refuses to process low-quality or thin data, reducing the risk of generating misleading or noisy outputs. It also hardcodes a 'sign contract' to ensure mathematical consistency.
Audit Metadata