longbridge-capital-flow
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the local binary
longbridgeto retrieve market data. - Evidence: Found in
scripts/cli.pywithin thecall_longbridgefunction. - Safety Measures: The script uses
subprocess.runwith a list of arguments (not a shell string), effectively preventing command injection. Additionally, the stock symbol input is strictly validated against a regex pattern (^[A-Z0-9]+\.(US|HK|SH|SZ|SG)$) before execution. - [SAFE]: Analysis of the skill's code and instructions found no malicious patterns.
- No hardcoded credentials or sensitive data exposure were detected.
- No obfuscation techniques or persistence mechanisms are present.
- External references point to official repositories associated with the vendor's financial services.
Audit Metadata