buffett-moat-screener

Warn

Audited by Gen Agent Trust Hub on Sep 8, 2026

Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill uses the pickle module in scripts/v9_backtest.py to manage research checkpoints. Because pickle can execute arbitrary code during deserialization, it is unsafe to use with untrusted or externally provided checkpoint files.
  • [DYNAMIC_EXECUTION]: The code utilizes the __import__ function for dynamic module loading within scripts/v9_backtest.py and scripts/feasibility.py. Dynamic loading can be a security risk if the imported module names are influenced by external input.
  • [COMMAND_EXECUTION]: The diagnostic and testing tools in scripts/test.py and tests/test_registry_contract.py use the subprocess module to run external processes like the pytest test runner. Spawning sub-processes is a privileged operation that requires careful control over arguments.
  • [SAFE]: The file scripts/offline_data.py contains hardcoded Windows-style absolute paths for a local data source. This is a configuration best-practice violation but does not pose a direct security threat.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Sep 8, 2026, 07:11 AM