hedgefund-citadel-technical
Warn
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill references a hardcoded absolute file path
/Users/engineer/.venv/bin/python3, which reveals a local username ('engineer') and internal directory structure. - [DYNAMIC_EXECUTION]: The instructions direct the agent to execute shell commands by interpolating user-provided inputs directly into the command line, specifically:
python .agents/skills/analyse-technical/scripts/ta.py <SYMBOL> --json. This creates a vulnerability to command injection if the ticker symbol input contains shell metacharacters. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests data from external sources and user-provided tickers to generate trade recommendations.
- Ingestion points: User input (
<SYMBOL>,ticker.json), TradingView API responses, and content fetched viaweb_fetch. - Boundary markers: The instructions lack explicit delimiters or instructions for the agent to ignore embedded commands within the external data.
- Capability inventory: The skill can execute Python scripts via the shell and perform network operations via external tools.
- Sanitization: There are no instructions to sanitize or validate the ticker symbols or external content before they are processed or used in shell commands.
Audit Metadata