senpi-trading-runtime
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Documentation in
references/runtime-cli.mdandSKILL.mddescribes a comprehensive CLI toolset (openclaw senpi) for managing trading runtimes. This includes commands for validating strategies (senpi validate), deploying them (senpi deploy), and inspecting live state (senpi dsl,senpi status). These are standard operations for the platform's intended use case. - [INDIRECT_PROMPT_INJECTION]: The
scripts/gen_catalog.pyscript implements a data ingestion process that reads metadata fromstrategy.yamlfiles within the repository to produce acatalog.json. While this represents a potential injection surface if malicious strategy files were introduced, the implementation usesyaml.safe_load()for secure parsing and operates on local files. This behavior is standard for catalog generation in this framework. - [SAFE]: The skill documents security boundaries, such as the read-only MCP interface described in
references/scan-contract.md, which prevents strategy code from performing unauthorized mutations. All external tool references (e.g.,@senpi-ai/runtime) originate from the recognized vendor.
Audit Metadata