strategy-compare
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates and saves a Python script named
{symbol}_strategy_comparison.pyto the local file system. The agent is then instructed to execute this dynamically generated code to perform the strategy comparison and generate visualizations. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided symbols and strategy names via
$ARGUMENTSand interpolates them directly into file paths and the content of the generated script, which represents an attack surface for indirect injection. - Ingestion points: User-provided input through the
$ARGUMENTSvariable, specifically the$0(symbol) and remaining strategy name arguments. - Boundary markers: The instructions do not define any boundary markers or delimiters to isolate user-provided data from the generated script logic.
- Capability inventory: The skill utilizes the
Writetool to create directories and files, and theBashtool for script execution and file system operations. - Sanitization: No explicit sanitization, validation, or escaping of the user-supplied arguments is performed before they are used to construct filenames and code content.
Audit Metadata