trader-regime
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
neural-traderpackage from the NPM registry. The use of the--ignore-scriptsflag is a positive security practice that prevents unauthorized code execution during the package installation phase. - [COMMAND_EXECUTION]: The skill utilizes shell commands via
npxto perform analysis. This introduces a potential command injection vector if user-supplied parameters (like symbols or tickers) are included in the command string without adequate sanitization. - [PROMPT_INJECTION]: The skill features an indirect prompt injection attack surface because it processes untrusted data from external tool outputs.
- Ingestion points: Output generated by the
neural-traderCLI tool in steps 2 and 3. - Boundary markers: None provided to distinguish data from instructions.
- Capability inventory: Includes the
Bashtool for shell execution and memory management tools for data persistence. - Sanitization: No explicit logic is defined to sanitize or validate the content received from the external command before processing.
Audit Metadata