alpaca
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a secure authentication mechanism using environment variables for API keys and secrets, adhering to best practices for credential management in agent skills.
- [SAFE]: Network operations are restricted to established Alpaca API domains (paper-api.alpaca.markets and api.alpaca.markets). All requests are performed over HTTPS.
- [SAFE]: A specific safety guard is implemented in the connection resolver that blocks orders and position-liquidating operations on live accounts unless an explicit opt-in environment variable (ALPACA_ALLOW_LIVE_TRADING) is configured.
- [SAFE]: The TypeScript source code for each of the 25 tools was reviewed and confirmed to only perform the functions described in the skill manifest, primarily wrapping Alpaca's REST API endpoints.
- [SAFE]: The CLI entry point (cli.js) uses standard subprocess spawning to execute the connector's logic, which is an expected pattern for this platform shape and presents no unusual security risk.
Audit Metadata