cot-contrarian-detector

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides Python scripts to be executed locally by the user to perform the market screening. These scripts use standard parameters for market selection and lookback periods.
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to financialmodelingprep.com (FMP) to fetch market data. FMP is a well-known financial data service. The skill handles the API key securely via environment variables or CLI arguments.
  • [CREDENTIALS_UNSAFE]: No hardcoded credentials were found. The skill includes a sophisticated _redact() function in screen_cot_crowding.py specifically designed to scrub API keys from error messages, logs, and generated reports before they are exposed to the user or saved to disk.
  • [DATA_EXPOSURE]: The skill does not access sensitive local files (SSH, AWS, etc.). It only writes generated market reports (JSON/Markdown) to a user-specified output directory (reports/ by default).
  • [PROMPT_INJECTION]: The skill contains clear instructional guardrails advising the agent that crowding detection is a "precondition" and not a trade signal, preventing the agent from giving unsolicited or unsafe investment advice.
  • [DYNAMIC_EXECUTION]: The calculation logic in cot_index.py is purely functional and mathematical, with no use of eval(), exec(), or dynamic path loading.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 05:41 PM
Security Audit — agent-trust-hub — cot-contrarian-detector