tigeropen

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation references remote installation scripts for the tigeropen CLI and the uv tool. These scripts are hosted on the vendor's official GitHub repository (tigerfintech) and well-known developer infrastructure (astral.sh).
  • [COMMAND_EXECUTION]: The skill includes instructions for using the tigeropen CLI to perform market queries and trade management directly from the terminal.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests real-time market data from TradeUP APIs and possesses capabilities to execute financial transactions. Potential risks associated with processing external data are addressed by mandatory safety instructions requiring that the agent displays order details (symbol, quantity, price, commission) and waits for explicit user confirmation before placing live orders.
  • Ingestion points: Market data quotes, option chains, and scanner results retrieved via QuoteClient (multiple files).
  • Boundary markers: None explicitly defined for API data, but high-level safety instructions act as logic boundaries.
  • Capability inventory: Order placement, modification, and fund transfers via TradeClient (trade.md).
  • Sanitization: Order previews and mandatory user confirmation steps are required for all non-paper accounts.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 02:29 PM