buffett-moat-screener
Warn
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill uses the
picklemodule inscripts/v9_backtest.pyto manage research checkpoints. Becausepicklecan execute arbitrary code during deserialization, it is unsafe to use with untrusted or externally provided checkpoint files. - [DYNAMIC_EXECUTION]: The code utilizes the
__import__function for dynamic module loading withinscripts/v9_backtest.pyandscripts/feasibility.py. Dynamic loading can be a security risk if the imported module names are influenced by external input. - [COMMAND_EXECUTION]: The diagnostic and testing tools in
scripts/test.pyandtests/test_registry_contract.pyuse thesubprocessmodule to run external processes like thepytesttest runner. Spawning sub-processes is a privileged operation that requires careful control over arguments. - [SAFE]: The file
scripts/offline_data.pycontains hardcoded Windows-style absolute paths for a local data source. This is a configuration best-practice violation but does not pose a direct security threat.
Audit Metadata