trade-performance-coach
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill utilizes deterministic Python logic to analyze local files provided by the user. No malicious behaviors such as command execution, data exfiltration, or obfuscation were identified. The script employs safe parsing methods (json.loads and yaml.safe_load) to process local data records.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a standard surface for indirect prompt injection due to its core function of processing user-generated journal text. 1. Ingestion points: The scripts/review_trade_performance.py script reads trade history and journal reflections from local JSON/YAML files. 2. Boundary markers: The script generates reports that include user text without specific isolation delimiters. 3. Capability inventory: The skill is restricted to reading and writing local files via its analysis script. 4. Sanitization: Inputs are parsed using standard safe libraries to prevent execution during the data loading phase.
Audit Metadata