trading-agents
Pass
Audited by Gen Agent Trust Hub on Jun 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust stock analysis system with multiple engines (LLM, local signals, and mock), which is a common pattern for production-ready tools. The local engine (
signals.py) utilizes standard quantitative finance libraries likenumpyandpandasto calculate common technical indicators such as RSI, MACD, and Bollinger Bands. - [SAFE]: Configuration management and sensitive information (API keys) are handled via standard
.envfiles. The skill searches for these files in predefined, expected locations such as the current working directory, the skill's own directory, and the standard OpenClaw workspace path (~/.openclaw/workspace/.env). This aligns with industry best practices for secret management. - [SAFE]: Data ingestion is limited to stock ticker symbols, which are used to fetch public market data from Yahoo Finance via the established
yfinancelibrary. This is a routine and safe operation for financial analysis skills. - [SAFE]: The code uses dynamic path insertion (
sys.path.insert) to resolve dependencies on the optionalTradingAgentsframework. This mechanism is directed at local sibling directories or paths explicitly defined by the user through theTRADING_AGENTS_HOMEenvironment variable, representing a standard integration technique rather than a security risk. - [SAFE]: All documented external resources, including GitHub repositories and academic papers, point to legitimate sources associated with the project's stated purpose.
Audit Metadata