adding-vela-indicators
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides instructions and examples for implementing and registering scripting engines (e.g., Pine Script, custom TypeScript indicators) to execute code against chart data. This is the intended functionality of the @luxalgo/vela charting SDK for extending platform capabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill documents methods for ingesting and executing external script sources via
chart.addIndicator()andchart.runScript(). While this represents an attack surface for untrusted script execution, the documentation includes security considerations such as using Content Security Policy (CSP) headers (worker-src blob:) and running engines within Web Workers to isolate execution. - [EXTERNAL_DOWNLOADS]: References installation and use of official vendor packages including
@luxalgo/vela,@luxalgo/vela-pinets, and@luxalgo/vela/plugin. These are legitimate dependencies for the library described in the skill.
Audit Metadata