trading-alert-scheduler-skill
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses
ArjunDivecha/ibkr-mcp-serverto interact with the user's local Interactive Brokers Gateway. This is a legitimate tool for portfolio management and requires a local installation and running gateway to function. - [SAFE]: Data collection is performed via standard web searches (Yahoo Finance, CBOE, etc.) and local portfolio access. No evidence of sending sensitive trading data or credentials to unauthorized external domains was found.
- [SAFE]: The skill implements a session-based scheduler via cron to automate pre-market digests, which is consistent with its stated purpose of reducing intraday distractions for the user.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests market data and news from external websites. While this creates a theoretical surface for indirect prompt injection, the risk is assessed as safe because the skill processes this data through a structured technical analysis framework (Markov regimes, Elliott Wave, etc.) rather than executing instructions contained within the market news. Mandatory Evidence Chain: 1) Ingestion: Web search for ticker news/catalysts (SKILL.md). 2) Boundary markers: Not explicitly defined for web content. 3) Capability: File-write for analytics sidecar, no remote code execution. 4) Sanitization: Results are formatted into a structured dashboard.
Audit Metadata