trader-memory-core

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches historical stock price data from Financial Modeling Prep (financialmodelingprep.com), a well-known financial data provider, to calculate performance metrics such as Maximum Adverse Excursion (MAE) and Maximum Favorable Excursion (MFE).
  • [COMMAND_EXECUTION]: A utility script (trader_memory_cli.py) utilizes subprocess.call to execute other scripts within the package. This functions as a subcommand launcher and optionally uses the uv tool to ensure that dependencies like jsonschema are available in the execution environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests investment data from external screener outputs (JSON) and manual trading journals (JSON/CSV), which could theoretically contain malicious instructions.
  • Ingestion points: thesis_ingest.py processes external files provided via the --input or --bulk-csv CLI flags.
  • Boundary markers: The skill employs strict JSON schema validation (schemas/thesis.schema.json) for all data entering the system.
  • Capability inventory: The skill performs local file system operations in the state/ directory, network requests to financial data providers, and internal script execution for task dispatching.
  • Sanitization: Ingested data is type-checked and validated against enums and format patterns (e.g., date-time, status codes) before being written to persistent storage or rendered in postmortem reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 11:20 AM
Security Audit — agent-trust-hub — trader-memory-core