strategy-compare

Pass

Audited by Gen Agent Trust Hub on Aug 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill generates and saves a Python script named {symbol}_strategy_comparison.py to the local file system. The agent is then instructed to execute this dynamically generated code to perform the strategy comparison and generate visualizations.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided symbols and strategy names via $ARGUMENTS and interpolates them directly into file paths and the content of the generated script, which represents an attack surface for indirect injection.
  • Ingestion points: User-provided input through the $ARGUMENTS variable, specifically the $0 (symbol) and remaining strategy name arguments.
  • Boundary markers: The instructions do not define any boundary markers or delimiters to isolate user-provided data from the generated script logic.
  • Capability inventory: The skill utilizes the Write tool to create directories and files, and the Bash tool for script execution and file system operations.
  • Sanitization: No explicit sanitization, validation, or escaping of the user-supplied arguments is performed before they are used to construct filenames and code content.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 23, 2026, 04:06 PM
Security Audit — agent-trust-hub — strategy-compare