position-sizer
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill's primary workflow requires the agent to run a local Python script (
scripts/position_sizer.py) to perform financial calculations. This execution is the intended purpose of the tool and is performed locally without external dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied trade parameters, creating a potential surface for indirect injection.
- Ingestion points: User data (account size, entry/stop prices) is ingested via command-line arguments in the
scripts/position_sizer.pyscript. - Boundary markers: The instructions do not define specific delimiters for user data, relying on the agent's natural language processing to extract numerical values.
- Capability inventory: The script can create directories and write JSON and Markdown reports to the local file system using
os.makedirsandopen(). - Sanitization: The tool includes a
validate_parametersfunction that enforces strict numerical constraints, such as ensuring positive values and logical price offsets, which mitigates the risk of malformed or malicious data affecting the calculations. - [DYNAMIC_EXECUTION]: The test suite in
scripts/tests/test_position_sizer.pyusessubprocess.runto verify the command-line interface of the tool. This usage is restricted to testing the skill's own components and does not introduce external execution risks to the agent's environment.
Audit Metadata