backtest-expert
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructions and referenced methodology files focus exclusively on systematic trading validation. The behavioral patterns observed are consistent with the stated educational and analytical purpose.
- [COMMAND_EXECUTION]: The skill includes
scripts/evaluate_backtest.py, a script intended to be executed by the agent or user. The script performs statistical calculations on user-supplied metrics and generates reports on the local file system. It does not perform network operations or access sensitive system configuration files. - [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for processing external trading performance data through its evaluation script.
- Ingestion points: Numeric metrics (win rate, trade count, drawdown, etc.) are ingested as command-line arguments in
scripts/evaluate_backtest.py. - Boundary markers: The script uses
argparsewith strict type enforcement (integers and floats), which naturally prevents the injection of natural language instructions into the script's logic. - Capability inventory: The script includes file system write capabilities to save JSON and Markdown reports to a user-specified directory.
- Sanitization: The
validate_inputsfunction ensures all ingested metrics are within logical ranges (e.g., win rates between 0 and 100, non-negative trade counts), mitigating accidental or intentional data corruption.
Audit Metadata