aipa-analyze
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides an installation command that pipes a script from 'astral.sh' directly to a shell. This is the official installation method for 'uv', which is a well-known and reputable service in the developer ecosystem.
- [EXTERNAL_DOWNLOADS]: Facilitates the download and installation of the 'aipa-cli' package from standard Python registries using 'uvx' or 'pip'. This package is the core tool of the skill authored by 'quanhua92'.
- [COMMAND_EXECUTION]: The skill uses 'uvx' and 'python3' CLI commands to perform financial analysis and data processing.
- [DYNAMIC_EXECUTION]: Includes Python code templates to be executed via command-line pipes. These are used to calculate deterministic metrics (like volume multipliers and Risk/Reward ratios) from raw data, which is a best practice to avoid calculation errors in AI analysis.
- [INDIRECT_PROMPT_INJECTION]: The skill has an inherent attack surface for indirect prompt injection via the processing of external financial data.
- Ingestion points: Market data, news events, and ticker metadata fetched from external sources via 'aipa-cli'.
- Boundary markers: No explicit delimiters for external content are defined in the instructions.
- Capability inventory: Shell command execution ('uvx', 'python3') and local file reads (portfolio and watchlist files).
- Sanitization: No explicit sanitization of tool-returned data is mentioned before processing.
Audit Metadata