a-share-strategy-allmarket-multi-swing-defensive

Pass

Audited by Gen Agent Trust Hub on Oct 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [DYNAMIC_EXECUTION]: The function _get_mainboard_universe_from_akshare in scripts/paper_trading/market_data.py executes a hardcoded Python script string using subprocess.run. This is used for filtering stock market data but represents a pattern of runtime script execution.
  • [COMMAND_EXECUTION]: The skill uses the subprocess module to run Python commands for data processing. While the arguments are sanitized by casting to integers, the use of shell execution primitives is noted.
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to several well-known financial data domains such as finance.sina.com.cn and gtimg.cn (Tencent) to retrieve market quotes and history. It also relies on the akshare library for financial data aggregation.
  • [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes data from external APIs.
  • Ingestion points: Market data retrieved via MarketDataProvider from Sina, Tencent, and Eastmoney APIs.
  • Boundary markers: None identified; the skill processes the incoming data as trusted financial metrics.
  • Capability inventory: Includes file system access (reading holdings files) and command execution via subprocess.run in market_data.py.
  • Sanitization: Data is parsed into numeric formats using pandas, which provides basic type-level sanitization for the analysis logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 6, 2026, 12:32 AM