futu-sim-trading
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill includes instructions to download and execute installation scripts directly via shell piping (
curl | sh) and PowerShell. These scripts are sourced from the developer's official GitHub repository (github.com/FutunnOpen) for the purpose of tool setup. - [EXTERNAL_DOWNLOADS]: Downloads configuration, setup scripts, and references documentation from the official Futu Open organization on GitHub.
- [COMMAND_EXECUTION]: Invokes the
futuCLI tool to perform paper-trading actions, such as querying account funds, listing positions, and placing simulated orders. - [PRIVILEGE_ESCALATION]: The Windows installation instructions utilize the
-ExecutionPolicy Bypassflag to allow the execution of the downloaded setup script. - [INDIRECT_PROMPT_INJECTION]: The skill processes JSON output from the external CLI tool, which serves as a data ingestion point that could theoretically be used for injection, though the risk is minimal given the specialized nature of the tool.
Audit Metadata