senpi-strategy-ops
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runwith list-based arguments inscripts/_cli.pyandscripts/run.shto callgitand theopenclawtool, preventing shell injection. - [EXTERNAL_DOWNLOADS]: It fetches strategy logic and metadata from the vendor's official GitHub repository (
github.com/Senpi-ai/senpi-skills) viascripts/_fetch.py. This is restricted to trusted vendor-controlled sources. - [REMOTE_CODE_EXECUTION]: The skill enables the execution of trading scanner scripts fetched from the vendor's GitHub. These are executed under the supervision of the
openclawruntime. - [SAFE]: Authentication tokens are handled securely via environment variables. The skill also employs directory traversal guards in its fetching logic and uses safe YAML parsing methods to mitigate injection and path manipulation risks.
Audit Metadata