algo-portfolio

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to run a generated Python script (run_portfolio.py) which manages the trading lifecycle. This is the primary function of the skill and is executed on the user's local environment.
  • [DYNAMIC_EXECUTION]: The generated runner script dynamically modifies the Python sys.path to locate and import its core PortfolioRunner logic from a relative path within the skill's internal directory structure (.claude/skills/algo-expert/rules/assets/core).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-controlled or agent-generated configuration from portfolio.yaml to determine which scripts to execute.
  • Ingestion points: The run_portfolio.py script reads the portfolio.yaml configuration file.
  • Boundary markers: None identified in the provided instructions or generated code.
  • Capability inventory: The skill has access to the Bash tool and the generated runner spawns subprocesses for each strategy script defined in the configuration.
  • Sanitization: No specific path validation or sanitization of the strategy script paths is performed before they are executed as subprocesses.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 07:35 PM