openalgo-chart-indicator

Pass

Audited by Gen Agent Trust Hub on Aug 21, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses rg (ripgrep) to verify the presence of required imports in the project source code, which is a standard development practice.
  • [DYNAMIC_EXECUTION]: The skill utilizes node -e commands to programmatically extract indicator metadata (id, name, category) from the openalgo-charts/indicators package and local build artifacts (./dist/openalgo-charts.indicators.mjs). These are discovery mechanisms used to assist the agent in selecting valid identifiers.
  • [COMMAND_EXECUTION]: The skill uses npx tsc --noEmit as a verification step to ensure that generated or modified code passes TypeScript type-checking without side effects.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a 'Tier-2' architecture via createTier2Indicator to ingest external analytics feeds (e.g., open interest, PCR).
  • Ingestion points: External analytics data feeds provided via API or subscription (processed in createTier2Indicator).
  • Boundary markers: None explicitly defined in the instruction text for the external data stream.
  • Capability inventory: The skill possesses Bash, Write, and Edit tool access.
  • Sanitization: The skill enforces strict temporal alignment (most recent point at or before bar time) and numeric processing, though it does not explicitly detail string sanitization for external feed metadata.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 21, 2026, 08:44 AM
Security Audit — agent-trust-hub — openalgo-chart-indicator