polytrackers-agent-skill

Pass

Audited by Gen Agent Trust Hub on Jul 23, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes an external bridge component, @polytrackers/mcp-stdio, which is downloaded and executed via npx. This package is an official resource provided by the skill's author (polytrackers) for stdio-only MCP host compatibility.
  • [COMMAND_EXECUTION]: The setup instructions involve standard shell commands using npx to initialize the MCP bridge. These commands are typical for the described workflow and do not involve privilege escalation or suspicious behavior.
  • [SAFE]: The skill implements robust security guardrails, including mandatory user approval for all real-money trades, the use of idempotency keys to prevent duplicate executions, and clear instructions for the agent to treat tool outputs as untrusted data. This latter instruction specifically mitigates potential indirect prompt injection attacks by warning the model to ignore any instructions embedded in market descriptions or anomaly notes.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 23, 2026, 04:41 AM