ctrader-mcp-servers
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a comprehensive set of instructions and utility scripts for financial calculations (pip math, position sizing, margin calculation, and unit encoding) specific to the cTrader platform. All bundled Python scripts in the
scripts/directory use only the standard library and perform deterministic mathematical operations without network or sensitive file access. - [SAFE]: The documentation in the
references/folder, including a 'Known Quirks Ledger' and 'Self-Healing Playbook', implements defensive programming practices. These instruct the agent to verify state before and after every mutating API call, protecting against common trading integration pitfalls such as race conditions or silent API behavioral changes. - [SAFE]: The skill's author, 'spotware', uses legitimate vendor domains (spotware.com) for license information, and all external references are consistent with the stated purpose of assisting with cTrader MCP server interactions.
- [INDIRECT_PROMPT_INJECTION]: As a tool-using skill that processes external API data (market prices, account balances) and possesses execution capabilities (bundled Python scripts), the skill naturally has a surface for indirect prompt injection. However, the instructions mandate strict validation gates, rounding logic, and schema-enforcement patterns which mitigate the risk of untrusted data influencing the agent's behavior maliciously. The severity is low as this is inherent to the functional design and include significant guardrails.
Audit Metadata