a-share-paper-trading
Pass
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule inscripts/paper_trading_ctl.pyandscripts/full_function_smoke_check.pyto manage the trading service's lifecycle. These calls use structured argument lists and avoid shell execution, ensuring commands are executed securely. - [EXTERNAL_DOWNLOADS]: Market data is fetched from reputable financial platforms including Tencent and Sina via their public APIs. These are well-known and expected sources for the skill's stated purpose of financial simulation.
- [SAFE]: The skill implements a persistence mechanism on macOS by creating a launchd agent in
~/Library/LaunchAgents/. This is a legitimate, documented feature of thepaper_trading_ctl.pyscript intended to keep the simulation service running. - [SAFE]: The application follows best practices for data storage by placing its SQLite database and log files in standard user-level directories such as
~/Library/Application Support/(macOS) or${XDG_DATA_HOME}(Linux). - [SAFE]: The code uses parameterized SQL queries throughout
scripts/paper_trading/engine.py, effectively preventing SQL injection vulnerabilities.
Audit Metadata