chart-indicator

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The validation utility validate.mjs is designed to fetch the openalgo-charts package from the official NPM registry when it is not already present in the environment. This ensures that custom indicators are tested against the specific library version defined in the project's configuration.
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to run the indicator validator and installation scripts. This execution is limited to internal maintenance tasks, such as verifying the integrity of generated JavaScript files.
  • [DYNAMIC_EXECUTION]: The validate.mjs script performs dynamic loading of newly created indicator files using JavaScript imports. This allows the tool to execute the indicator's logic against synthetic market data fixtures to verify that the output columns match the expected lengths and data types required by the chart.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided trading studies (such as Pine Script) to port them to JavaScript. The ingestion point for this untrusted data is the user's initial request. While explicit boundary markers are absent in the prompt, the skill mitigates risk through its capability inventory: it uses the Write tool for local file creation and Bash for validation. Sanitization is performed by the validator, which enforces a strict structural schema on the generated code and catches runtime errors during the testing phase.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 09:59 AM