tigeropen-java
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses official vendor-provided SDKs and documentation resources. It utilizes the
io.github.tigerbrokers:openapi-java-sdkMaven dependency and references official domains such astradeup.comanddeveloper.tradeup.comfor API documentation. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external market data and possesses high-impact trading capabilities, creating a potential surface for indirect prompt injection. Ingestion points: Market quotes, option chains, and account position data ingested in
references/quote.md,references/option.md, andreferences/account.md. Capability inventory: Financial trading actions (place, modify, and cancel orders) are available across the skill, particularly inreferences/trade.md. Boundary markers: Present. The skill includes explicit instructions to default to paper trading and provides a mandatory safety workflow for live transactions. Sanitization: The skill implements a human-in-the-loop requirement, mandating that the agent must wait for explicit user confirmation after displaying order details and estimated impacts before submitting live orders.
Audit Metadata