traderspy-trading-signals
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or dangerous capabilities were detected in the skill instructions or referenced files. The skill correctly implements safety boundaries by explicitly stating it cannot place trades and by providing financial risk warnings to the user.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as an interface for external data from the TraderSpy API, creating a potential surface for indirect injection.
- Ingestion points: Untrusted data enters the agent context through the results of
get_signals,get_signal_details, andget_signal_statstools, which interface withhttps://mcp.traderspy.app/mcp. - Boundary markers: The skill does not define explicit delimiters for the tool output data.
- Capability inventory: The skill is entirely read-only and has no access to shell execution, file system modifications, or secondary network exfiltration tools.
- Sanitization: No sanitization is performed on the incoming market data, but the lack of exploitable tools makes the security risk negligible.
Audit Metadata