skills/shouldnotappearcalm/a-share-skill/a-share-strategy-allmarket-multi-swing-defensive/Gen Agent Trust Hub
a-share-strategy-allmarket-multi-swing-defensive
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The function
_get_mainboard_universe_from_akshareinscripts/paper_trading/market_data.pyexecutes a hardcoded Python script string usingsubprocess.run. This is used for filtering stock market data but represents a pattern of runtime script execution. - [COMMAND_EXECUTION]: The skill uses the
subprocessmodule to run Python commands for data processing. While the arguments are sanitized by casting to integers, the use of shell execution primitives is noted. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to several well-known financial data domains such as
finance.sina.com.cnandgtimg.cn(Tencent) to retrieve market quotes and history. It also relies on theaksharelibrary for financial data aggregation. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes data from external APIs.
- Ingestion points: Market data retrieved via
MarketDataProviderfrom Sina, Tencent, and Eastmoney APIs. - Boundary markers: None identified; the skill processes the incoming data as trusted financial metrics.
- Capability inventory: Includes file system access (reading holdings files) and command execution via
subprocess.runinmarket_data.py. - Sanitization: Data is parsed into numeric formats using
pandas, which provides basic type-level sanitization for the analysis logic.
Audit Metadata