futu-grid-strategy
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements strict privacy guidelines, specifically instructing the AI not to store, echo, or log sensitive credentials like passwords, AppKeys, or private keys.
- [SAFE]: The instructions include mandatory financial safety checks (labeled G1-G6) that validate parameters against market data before any trading code is executed, protecting the user from unfavorable trading conditions such as high fees or illiquidity.
- [SAFE]: All external references and network operations are directed to the official Futu OpenAPI domains (webapi.futunn.com and open.futunn.com).
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external market data, which presents a surface for indirect prompt injection.
- Ingestion points: Market quotes and historical K-line data are fetched from the Futu historical K-line and quote snapshot endpoints (SKILL.md).
- Boundary markers: None explicitly mentioned for data ingestion; however, the data is treated as numerical input for fixed formulas (G1-G6) rather than instructional text.
- Capability inventory: Performs network requests to webapi.futunn.com, writes local state to a JSON file, and places trading orders via API (SKILL.md).
- Sanitization: Parameters are validated against specific numerical thresholds and exchange-specific tick tables before use.
Audit Metadata