trader-rebalance
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
rebalance.pyto calculate portfolio drift and generate trade proposals based on user-defined parameters. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from several local JSON files which could potentially contain malicious instructions if the tools generating those files are compromised.
- Ingestion points: The script reads data from
trader/portfolio.json,trader/prices.json,trader/targets.json, andtrader/config.jsonvia theread_jsonandparse_targetsfunctions. - Boundary markers: Output is formatted as a drift table for the agent to display, but the skill does not use specific delimiters to isolate external data from its own instructions.
- Capability inventory: The skill is capable of reading and writing local files within the
trader/directory. It does not perform network operations or execute arbitrary subprocesses. - Sanitization: Input data is parsed as JSON and numerical values are cast to floating-point numbers or integers, which mitigates many common injection vectors by stripping non-numerical content from calculations.
Audit Metadata