portfolio-manager
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: Comprehensive analysis of the skill's instructions, metadata, and scripts revealed no malicious patterns, prompt injection attempts, or security vulnerabilities.
- [DATA_EXFILTRATION]: The skill performs network operations to fetch market data and holdings from official Alpaca API domains (alpaca.markets). These operations are essential for the skill's primary function and do not involve exfiltration to untrusted third-party servers.
- [CREDENTIALS_UNSAFE]: The skill follows standard security procedures by directing users to store Alpaca API keys in environment variables (
ALPACA_API_KEY,ALPACA_SECRET_KEY) rather than hardcoding them. This ensures that sensitive credentials remain under the user's control. - [INDIRECT_PROMPT_INJECTION]: While the skill ingests external data from financial APIs and user-provided CSV files, it processes this information specifically for financial analysis and reporting. No exploitable vulnerabilities related to data poisoning were found.
- [COMMAND_EXECUTION]: The provided diagnostic and reconciliation scripts (
check_alpaca_connection.py,reconcile_positions.py) are used for local environment verification. These scripts use safe execution patterns and do not expose the system to arbitrary command injection from untrusted sources.
Audit Metadata