0dte-flow
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides curl command templates for querying the Tradier API and placing trade orders. These are intended for use within a financial decision-support context.
- [EXTERNAL_DOWNLOADS]: The skill communicates with api.tradier.com. This interaction is consistent with the skill's purpose as a trading tool for a well-known financial service.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (Ghost Alpha signals and Tradier market data). Ingestion points: Ghost Alpha signals and Tradier API (SKILL.md). Boundary markers: Logical entry/exit rules and pre-session checklist (SKILL.md). Capability inventory: Shell command execution via curl (SKILL.md). Sanitization: Absent.
- [CREDENTIALS_UNSAFE]: The skill correctly manages sensitive credentials by instructing the agent to pull them from a secure vault (VaultGuard) rather than hardcoding them in the file.
Audit Metadata