gold-buy-signal
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Executes a local host-side bash script at
~/.config/gold-signal/run.shto generate deterministic trade signals based on current market data. - [COMMAND_EXECUTION]: Executes a local Python script at
~/workspace/proxiblue/trading-agents/run_gold_check.pyto refresh a multi-agent LLM analysis of gold-related ETFs. - [INDIRECT_PROMPT_INJECTION]: The skill processes financial data and analyst calls from three external websites and four market drivers through a local engine.
- Ingestion points: Data is ingested from the output of the host scripts and JSON state files stored in
~/.config/gold-signal/state/and~/workspace/proxiblue/trading-agents/state/. - Boundary markers: Instructions require the agent to parse a structured JSON payload and focus on specific fields (
verdict,reason) to prevent misinterpretation of raw scraped content. - Capability inventory: The skill possesses the capability to execute shell commands and Python scripts on the host system to perform its primary function.
- Sanitization: The skill relies on the deterministic logic of the local engine to parse external content before the agent processes it, though no explicit sanitization step is detailed for the resulting JSON.
- [EXTERNAL_DOWNLOADS]: The documentation provides troubleshooting steps for setting up the local engine environment, which includes downloading dependencies via
pipand installing Playwright browser binaries.
Audit Metadata