saas-short-trader
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches market and sentiment data from various external publishers including Alpaca, SEC Filings (via SerenDB), Google Trends, and Perplexity/Exa.
- [COMMAND_EXECUTION]: Provides detailed instructions for setting up a local trigger server (
run_agent_server.py) and configuring cron jobs on the Seren platform. These operations involve shell commands and Python script execution. - [DATA_EXFILTRATION]: Persists trading strategy results, PnL tracking data, and self-learning artifacts to a remote SerenDB instance. This is a core part of the skill's documented functionality for cross-session persistence.
- [CREDENTIALS_UNSAFE]: The skill manages a
SEREN_API_KEYused for authenticating with the Seren platform and Alpaca. It provides instructions for secure management via environment variables and.envfiles, and includes a registration step via an official API endpoint. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from SEC filings and news summaries. However, it processes this data using deterministic keyword scoring and numerical clamping in
strategy_engine.pyrather than passing raw text back to the agent for instruction following. - Ingestion points:
strategy_engine.py(SEC filings, Google Trends, News/Perplexity). - Boundary markers: Uses structured SQL queries and JSON responses for data retrieval.
- Capability inventory: Network requests via
requestsandurllib, SQL execution via MCP andpsycopg. - Sanitization: Numerical extraction and keyword counting with clamping are used to generate stock scores.
Audit Metadata