algo-portfolio
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to run a generated Python script (run_portfolio.py) which manages the trading lifecycle. This is the primary function of the skill and is executed on the user's local environment. - [DYNAMIC_EXECUTION]: The generated runner script dynamically modifies the Python
sys.pathto locate and import its corePortfolioRunnerlogic from a relative path within the skill's internal directory structure (.claude/skills/algo-expert/rules/assets/core). - [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled or agent-generated configuration from
portfolio.yamlto determine which scripts to execute. - Ingestion points: The
run_portfolio.pyscript reads theportfolio.yamlconfiguration file. - Boundary markers: None identified in the provided instructions or generated code.
- Capability inventory: The skill has access to the
Bashtool and the generated runner spawns subprocesses for each strategy script defined in the configuration. - Sanitization: No specific path validation or sanitization of the strategy script paths is performed before they are executed as subprocesses.
Audit Metadata