position-sizer

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill's primary workflow requires the agent to run a local Python script (scripts/position_sizer.py) to perform financial calculations. This execution is the intended purpose of the tool and is performed locally without external dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied trade parameters, creating a potential surface for indirect injection.
  • Ingestion points: User data (account size, entry/stop prices) is ingested via command-line arguments in the scripts/position_sizer.py script.
  • Boundary markers: The instructions do not define specific delimiters for user data, relying on the agent's natural language processing to extract numerical values.
  • Capability inventory: The script can create directories and write JSON and Markdown reports to the local file system using os.makedirs and open().
  • Sanitization: The tool includes a validate_parameters function that enforces strict numerical constraints, such as ensuring positive values and logical price offsets, which mitigates the risk of malformed or malicious data affecting the calculations.
  • [DYNAMIC_EXECUTION]: The test suite in scripts/tests/test_position_sizer.py uses subprocess.run to verify the command-line interface of the tool. This usage is restricted to testing the skill's own components and does not introduce external execution risks to the agent's environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 11:59 AM