stock-deep-dive
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Node.js script (
dossier.mjs) to gather data and a Python subprocess via a sibling skill's virtual environment (render_chart.py) to generate charts. Ticker symbols passed as arguments are sanitized using a whitelist regular expression (/[^A-Z.]/g) to prevent command injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: Market data is retrieved from two external endpoints:
traderdaddy-pro-whop-production.up.railway.appandapi.tickertrace.pro. These requests include a browser-like User-Agent to avoid blocking by web application firewalls and communicate using the global fetch API. - [CREDENTIALS_UNSAFE]: The skill manages authentication by reading the
AGENT_API_KEYfrom a.env_agent_apifile located in the repository root. This approach follows standard security practices for local secret management and avoids hardcoding sensitive tokens within the source code.
Audit Metadata