indicator-setup

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to manage the local environment.
  • Detects the operating system using uname.
  • Creates and activates Python virtual environments.
  • Manages directory structures using mkdir.
  • [DYNAMIC_EXECUTION]: The skill uses python -c to execute a verification script after installation.
  • The script imports installed libraries and performs a basic indicator calculation to ensure the environment is functional.
  • The executed code is static and contained within the skill instructions.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts a user-provided argument for the Python version which is interpolated into shell commands.
  • Ingestion points: The $0 argument (python-version) defined in the skill frontmatter.
  • Boundary markers: None present for the shell command interpolation.
  • Capability inventory: The skill uses the Bash and Write tools to execute commands and create configuration files.
  • Sanitization: No explicit sanitization of the Python version string is performed before it is used in the virtual environment creation command.
  • [EXTERNAL_DOWNLOADS]: The skill installs several third-party Python packages from the standard registry (PyPI).
  • Packages include yfinance, plotly, dash, streamlit, numpy, pandas, matplotlib, and seaborn.
  • The openalgo package is a vendor-specific resource related to the skill author.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:20 AM