senpi-trader-research
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions require the agent to execute a local Python script (
scripts/research.py) using the host environment to perform trader discovery and analysis. - [EXTERNAL_DOWNLOADS]: The skill's communication helper (
scripts/mcp_client.py) performs network operations tomcp.prod.senpi.ai, which is the official API endpoint for the vendor ('senpi-ai'). These operations are limited to fetching market data and trader statistics. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data originating from the Hyperliquid exchange, creating a potential surface for indirect prompt injection if trader metadata contains malicious instructions.
- Ingestion points: Data is ingested via
discovery_andleaderboard_API calls performed inscripts/research.py. - Boundary markers: The
SKILL.mdfile provides clear instructions to "Read its JSON" and only use values returned by the engine, establishing logical boundaries for the agent's interpretation. - Capability inventory: The skill has the capability to execute local scripts and perform network communication with the vendor's API.
- Sanitization: External data is strictly parsed as JSON using Python's standard library before processing, minimizing structural confusion.
- [DYNAMIC_EXECUTION]: The main engine script dynamically imports its helper module (
mcp_client) from the local skill directory using standard Python import mechanisms.
Audit Metadata