skills/okx/plugin-store/starter-coach/Gen Agent Trust Hub

starter-coach

Pass

Audited by Gen Agent Trust Hub on May 7, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run in onchainos.py and coach.py to interact with the OnchainOS CLI and verify generated bot scripts. This is the intended primary purpose of the skill and is implemented with internal verification steps to ensure commands are valid and scoped to the project's requirements.
  • [REMOTE_CODE_EXECUTION]: The skill generates Python bot scripts based on user preferences and strategy specifications. While it executes these scripts locally during a 'smoke-test' verification phase, it uses a multi-layer harness—including syntax checks and method validation against the OnchainOS client—to ensure the generated code is safe and valid before it is provided to the user.
  • [DATA_EXFILTRATION]: The skill processes on-chain data such as wallet balances and trade history. All data retrieval and transaction signing are performed via the OnchainOS CLI, which utilizes a Trusted Execution Environment (TEE). No sensitive data is sent to untrusted external domains; LLM-based strategy generation utilizes standard Anthropic API integration for the core logic.
  • [PROMPT_INJECTION]: The skill processes user-provided natural language to build trading strategies. It mitigates potential indirect injection or hallucination risks through a 'hallucination-hardened' generation process in llm_strategy.py that includes structural normalization and a validation harness with a retry loop to ensure the output conforms to a strict schema.
  • [CREDENTIALS_UNSAFE]: The skill follows secure practices by not requesting or storing API keys or private keys. It relies on the Agentic Wallet path provided by OnchainOS for secure, TEE-based signing of all transactions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 7, 2026, 04:04 AM