hedge-backtesting
Warn
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill performs dynamic code generation by translating user-provided strategy rules into a Python script (
backtest_<slug>.py) and then executing it via a subprocess. This creates a vector for arbitrary code execution if the input rules are manipulated into containing malicious logic. - [COMMAND_EXECUTION]: The agent is instructed to execute shell commands using specific system paths and command-line utilities:
/Users/engineer/.venv/bin/python3 .cache/hedge-backtesting/<slug>/backtest_<slug>.py 2>&1 | tee .cache/hedge-backtesting/<slug>/run.log. The use of hardcoded environment paths reveals information about the host system structure. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes external, untrusted strategy rules and interpolates them into executable code.
- Ingestion points: Strategy rules are ingested from the user or the
hedge-strategy-generationskill (SKILL.md). - Boundary markers: The instructions lack formal delimiters or "ignore instructions" warnings when processing these rules.
- Capability inventory: The agent has the capability to write files, execute shell commands, and perform network requests through the yfinance library.
- Sanitization: There is no specified sanitization or validation logic to ensure the rules do not contain malicious code or shell escapes before being written to the script.
Audit Metadata