trader-train
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'neural-trader' package from the public NPM registry using npm install.- [COMMAND_EXECUTION]: The skill uses 'npx' to execute the neural-trader package, which involves running external code within the local environment.- [INDIRECT_PROMPT_INJECTION]: The skill processes training metrics and predictions from the neural-trader tool and stores them in the agent's memory, creating a potential surface for untrusted data to influence future agent logic.
- Ingestion points: Output (loss curves, validation metrics, predictions) from 'npx neural-trader' execution.
- Boundary markers: Absent; no specific instructions to ignore embedded commands in the tool output.
- Capability inventory: 'Bash' tool for command execution, 'mcp__plugin_ruflo-core_ruflo__memory_store' for data persistence, and 'mcp__plugin_ruflo-core_ruflo__neural_train' for subsequent model training.
- Sanitization: Absent; tool output is stored directly in memory.
Audit Metadata