fintech-algorithms
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/lookup.mjsutility fetches documentation metadata fromhttps://docs.thefintechbuilder.com/reference/payload.jsonand versioning information fromhttps://docs.thefintechbuilder.com/version.jsonto provide reference functionality. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external financial market data (trades, bars, quotes), creating an attack surface for indirect prompt injection.
- Ingestion points: Market data is ingested and adapted into library-specific shapes from various sources (REST APIs, CSV, websockets) as described in
references/ingestion.md. - Boundary markers: The skill mandates the use of validation guards and explicit branching on validity results, as documented in
SKILL.mdandreferences/recipes.md. - Capability inventory: The library functions are zero-dependency mathematical utilities; the
scripts/lookup.mjsscript is limited to JSON fetching and caching in the temporary directory. - Sanitization: Input data is sanitized using dedicated validation modules including
ohlc-consistency-validator,duplicate-trade-resolver, andhampel-bad-tick-filteras mapped inreferences/ingestion.md. - [DYNAMIC_EXECUTION]: The library exposes a
runnerfunction in its root export that allows algorithms to be dynamically loaded and executed by their catalog ID, enabling registry-driven workflows within the local package scope.
Audit Metadata