trading-agents

Pass

Audited by Gen Agent Trust Hub on Jun 1, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements a robust stock analysis system with multiple engines (LLM, local signals, and mock), which is a common pattern for production-ready tools. The local engine (signals.py) utilizes standard quantitative finance libraries like numpy and pandas to calculate common technical indicators such as RSI, MACD, and Bollinger Bands.
  • [SAFE]: Configuration management and sensitive information (API keys) are handled via standard .env files. The skill searches for these files in predefined, expected locations such as the current working directory, the skill's own directory, and the standard OpenClaw workspace path (~/.openclaw/workspace/.env). This aligns with industry best practices for secret management.
  • [SAFE]: Data ingestion is limited to stock ticker symbols, which are used to fetch public market data from Yahoo Finance via the established yfinance library. This is a routine and safe operation for financial analysis skills.
  • [SAFE]: The code uses dynamic path insertion (sys.path.insert) to resolve dependencies on the optional TradingAgents framework. This mechanism is directed at local sibling directories or paths explicitly defined by the user through the TRADING_AGENTS_HOME environment variable, representing a standard integration technique rather than a security risk.
  • [SAFE]: All documented external resources, including GitHub repositories and academic papers, point to legitimate sources associated with the project's stated purpose.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 1, 2026, 02:51 PM
Security Audit — agent-trust-hub — trading-agents