backtest-validator

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts scripts/walk_forward.py and scripts/slippage_stress.py utilize subprocess.run to call the local backtest.py file. This is the intended primary function of the skill to automate the validation gauntlet. The scripts employ argument lists and shlex.split, which are best practices for preventing shell injection vulnerabilities.
  • [SAFE]: The skill uses well-known and trusted Python libraries for data processing and statistical analysis, specifically numpy, pandas, and scipy.
  • [SAFE]: File operations are restricted to reading local trade logs (CSV) and writing summary reports (JSON/Markdown) to the local workspace. No network calls to non-whitelisted domains or access to sensitive system directories (e.g., .ssh, .aws) were identified.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 05:07 PM
Security Audit — agent-trust-hub — backtest-validator