alpaca
Pass
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill is professionally written and implements legitimate financial services functionality through official channels.
- [CREDENTIALS_UNSAFE]: The skill adheres to security best practices by loading API credentials from environment variables in a
.envfile rather than hardcoding them. No credentials or sensitive data are exposed in the source code. - [EXTERNAL_DOWNLOADS]: The skill requires the
alpaca-pylibrary, which is the official and trusted SDK for the Alpaca API service. - [COMMAND_EXECUTION]: User inputs such as stock symbols, quantities, and order types are safely processed through the Python
argparselibrary and passed as typed arguments to the SDK, preventing command injection risks. - [SAFE]: The implementation includes a mandatory
--confirm-livesafety flag for any operations affecting a live brokerage account, serving as a robust safeguard against unintentional real-money transactions.
Audit Metadata