factor-alpha191-alpha101

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: Deterministic Factor Computation. The skill is designed for the mathematical calculation of classic financial factors (Alpha101, Alpha158, Alpha191) using standard libraries such as NumPy, Pandas, and SciPy. All formula logic is local and verifiable.
  • [SAFE]: Data Handling. The skill operates on local CSV files provided by the user via configuration. It does not perform network operations, access sensitive system paths (like .ssh or .aws), or exfiltrate data.
  • [DYNAMIC_EXECUTION]: The Alpha158 engine uses a modular architecture that dynamically loads factor definition scripts from the internal scripts/alpha_runtime/alpha158_native/ directory using importlib.util. This follows a standard plugin pattern and is strictly limited to the skill's own distributed package content.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface for indirect injection by ingesting untrusted data from market CSV files and JSON configurations.
  • Ingestion points: load_market_data_frame in data.py reads user-supplied CSV files.
  • Boundary markers: Not explicitly present in data files, but data is treated as purely numerical input for math formulas.
  • Capability inventory: File writing (CSV results) and standard math computation; no arbitrary command execution or network access.
  • Sanitization: Input is passed through pd.to_numeric with errors='coerce', which effectively strips non-numeric content from computation fields.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:32 AM