manifoldbt-backtester
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill operates locally on user-provided data and does not engage in unauthorized network activity or credential access.
- [EXTERNAL_DOWNLOADS]: The skill utilizes the manifoldbt and pandas Python packages for its primary backtesting and data processing functions. These are legitimate dependencies for the skill's stated purpose.
- [COMMAND_EXECUTION]: The skill generates a command-line string to be used with external evaluation tools. It correctly employs the shlex library to sanitize the generated string, mitigating potential command injection risks for the user.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests strategy specifications from JSON files and market data from CSV/Parquet files. Potential risks are mitigated by a validation layer in scripts/spec.py that enforces a strict schema for all indicators and logic, preventing arbitrary data from executing unauthorized operations.
Audit Metadata