trader-scanner
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches symbol directories from Nasdaq's official domain (
nasdaqtrader.com) and retrieves stock price data from Yahoo Finance (query1.finance.yahoo.com,query2.finance.yahoo.com) to perform its scanning functions. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external financial sources which could theoretically contain malicious instructions.
- Ingestion points: External data is ingested from Nasdaq Trader (symbol directories) and Yahoo Finance (spark and chart data) within
scan.py. - Boundary markers: Not explicitly defined for the processed data; however, the skill expects specific structured formats (pipe-delimited and JSON).
- Capability inventory: The skill has file-writing capabilities to the local filesystem (
trader/universe.txt,trader/watchlist.json) via standard Python file operations. - Sanitization: The skill performs field-level parsing and applies regex-based filtering to tickers and symbols, significantly limiting the surface for processing arbitrary instructions embedded in the data.
Audit Metadata