trader-timemachine
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves historical stock price data from Yahoo Finance via the query1/query2.finance.yahoo.com endpoints. This is a well-known financial service, and the data is used strictly for statistical simulations.
- [COMMAND_EXECUTION]: The skill executes a local Python script,
timemachine.py, to perform simulations. The script is entirely composed of Python standard library modules and contains no calls to external binaries or shell command injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local plan files and external API responses from Yahoo Finance. It mitigates injection risks by performing strictly numerical processing and simulations, and the resulting statistical output is passed back to the agent in a structured manner.
- [DATA_EXFILTRATION]: No evidence of sensitive data exfiltration was found. Network activity is limited to fetching market data, and the script does not access sensitive system files or environment variables.
Audit Metadata