polytrackers-agent-skill
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes an external bridge component,
@polytrackers/mcp-stdio, which is downloaded and executed vianpx. This package is an official resource provided by the skill's author (polytrackers) for stdio-only MCP host compatibility. - [COMMAND_EXECUTION]: The setup instructions involve standard shell commands using
npxto initialize the MCP bridge. These commands are typical for the described workflow and do not involve privilege escalation or suspicious behavior. - [SAFE]: The skill implements robust security guardrails, including mandatory user approval for all real-money trades, the use of idempotency keys to prevent duplicate executions, and clear instructions for the agent to treat tool outputs as untrusted data. This latter instruction specifically mitigates potential indirect prompt injection attacks by warning the model to ignore any instructions embedded in market descriptions or anomaly notes.
Audit Metadata