chart-indicator
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The validation utility
validate.mjsis designed to fetch theopenalgo-chartspackage from the official NPM registry when it is not already present in the environment. This ensures that custom indicators are tested against the specific library version defined in the project's configuration. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to run the indicator validator and installation scripts. This execution is limited to internal maintenance tasks, such as verifying the integrity of generated JavaScript files. - [DYNAMIC_EXECUTION]: The
validate.mjsscript performs dynamic loading of newly created indicator files using JavaScript imports. This allows the tool to execute the indicator's logic against synthetic market data fixtures to verify that the output columns match the expected lengths and data types required by the chart. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided trading studies (such as Pine Script) to port them to JavaScript. The ingestion point for this untrusted data is the user's initial request. While explicit boundary markers are absent in the prompt, the skill mitigates risk through its capability inventory: it uses the
Writetool for local file creation andBashfor validation. Sanitization is performed by the validator, which enforces a strict structural schema on the generated code and catches runtime errors during the testing phase.
Audit Metadata