factor-alpha191-alpha101
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: Deterministic Factor Computation. The skill is designed for the mathematical calculation of classic financial factors (Alpha101, Alpha158, Alpha191) using standard libraries such as NumPy, Pandas, and SciPy. All formula logic is local and verifiable.
- [SAFE]: Data Handling. The skill operates on local CSV files provided by the user via configuration. It does not perform network operations, access sensitive system paths (like .ssh or .aws), or exfiltrate data.
- [DYNAMIC_EXECUTION]: The Alpha158 engine uses a modular architecture that dynamically loads factor definition scripts from the internal
scripts/alpha_runtime/alpha158_native/directory usingimportlib.util. This follows a standard plugin pattern and is strictly limited to the skill's own distributed package content. - [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect injection by ingesting untrusted data from market CSV files and JSON configurations.
- Ingestion points:
load_market_data_frameindata.pyreads user-supplied CSV files. - Boundary markers: Not explicitly present in data files, but data is treated as purely numerical input for math formulas.
- Capability inventory: File writing (CSV results) and standard math computation; no arbitrary command execution or network access.
- Sanitization: Input is passed through
pd.to_numericwitherrors='coerce', which effectively strips non-numeric content from computation fields.
Audit Metadata