alpaca-trading-hardened
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: No malicious patterns were detected. The skill is designed with a security-first approach, including explicit instructions to prevent common vulnerabilities associated with financial trading agents.- [COMMAND_EXECUTION]: The skill facilitates the execution of financial trades and account management through the apcacli command-line tool. These operations are the primary purpose of the skill and are accompanied by safety guidelines, such as recommending paper trading and command verification.- [CREDENTIALS_UNSAFE]: The skill requires Alpaca API credentials (APCA_API_KEY_ID and APCA_API_SECRET_KEY). It follows security best practices by instructing users to store these in environment variables and provides strict guardrails to prevent the agent from displaying or logging the actual credential values.- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the apcacli utility from a public registry via the cargo package manager, which is a standard procedure for this toolset.
Audit Metadata