cot-contrarian-detector
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill securely handles Financial Modeling Prep API credentials by using environment variables (
FMP_API_KEY) and implements multi-layered redaction logic (_redactand_cot_redact) to ensure keys are stripped from error logs and generated reports. - [INDIRECT_PROMPT_INJECTION]: The skill fetches external data from the FMP API. The risk is minimized as the ingestion focuses on numeric financial fields which are sanitized through integer/float conversion for calculation, and the output is presented in structured Markdown tables.
- Ingestion points: FMP Commitment of Traders API endpoints (
stable/commitment-of-traders-report) inscripts/fmp_client.py. - Boundary markers: Implicitly handled by Markdown table formatting in the generated reports produced by
scripts/screen_cot_crowding.py. - Capability inventory: Writing JSON and Markdown reports to a local directory; guiding the agent through manual news analysis steps using standard instructions.
- Sanitization: Strict numeric conversion of position and open interest data before processing in
scripts/cot_index.py. - [DYNAMIC_EXECUTION]: The test suite (
scripts/tests/test_fmp_client_contract.py) contains a dynamic import of the standarddatetimemodule. This is used solely for monkeypatching the current date during testing and is a benign development practice.
Audit Metadata