{"data":{"skill":{"slug":"sickn33-backtesting-frameworks","name":"backtesting-frameworks","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/backtesting-frameworks","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"3d11610b-9ecf-40ac-9b1b-b1eda9c01b24","skill_id":"469b3269-c01b-401a-a365-14654eec2ec7","version":5,"content_hash":"v3:5a26d1d61d694db29af9b138c661c1981076d9df:501f0fcb323900c30ebf717ad04e1c0ce7aebf93b798e9b08639c3f8ac3c0fad:0e8d728a21a1652be4c5f3e0b3b6163a213b97ceb723e0391eec12c045215f93:736b696c6c732f7369636b6e33332f6261636b74657374696e672d6672616d65776f726b73:96a49730b5f15d03c6e6a6f3f7aafd94","risk_level":"safe","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 11 static findings are false positives caused by Python type annotations, dictionary methods, ordinary prose, and Markdown code formatting. No executable scripts, shell commands, credential access, reconnaissance behavior, or prompt injection were found.","remediation":[],"risk_factor_evidence":[{"factor":"scripts","evidence":[{"file":"resources/implementation-playbook.md","line_end":403,"line_start":403}]},{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":33,"line_start":33},{"file":"SKILL.md","line_end":42,"line_start":42}]}],"critical_findings":[],"high_findings":[],"medium_findings":[],"low_findings":[],"dangerous_patterns":[],"files_scanned":2,"total_lines":696,"audit_model":"codex","audited_at":"2026-08-14T09:47:28.977+00:00","created_at":"2026-08-15T04:54:56.960659+00:00","static_findings":[{"id":"scripts:resources/implementation-playbook.md:403:dynamic-function-constructor","file":"resources/implementation-playbook.md","pattern":"Dynamic function constructor","snippet":"strategy_func: Function(data, **params) -> results dict","category":"scripts","line_end":403,"severity":"high","line_start":403},{"id":"sensitive:resources/implementation-playbook.md:448:certificate-key-files","file":"resources/implementation-playbook.md","pattern":"Certificate/key files","snippet":"param_names = list(param_grid.keys())","category":"sensitive","line_end":448,"severity":"high","line_start":448},{"id":"blocker:resources/implementation-playbook.md:263:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"# Generate signals (shifted to avoid look-ahead)","category":"blocker","line_end":263,"severity":"low","line_start":263},{"id":"blocker:resources/implementation-playbook.md:443:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"\"\"\"Grid search for best parameters.\"\"\"","category":"blocker","line_end":443,"severity":"low","line_start":443},{"id":"blocker:resources/implementation-playbook.md:630:system-reconnaissance","file":"resources/implementation-playbook.md","pattern":"System reconnaissance","snippet":"- **Use point-in-time data** - Avoid look-ahead bias","category":"blocker","line_end":630,"severity":"low","line_start":630},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- If detailed examples are required, open `resources/implementation-playbook.md`.","category":"external_commands","line_end":33,"severity":"medium","line_start":33},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `resources/implementation-playbook.md` for detailed patterns and examples.","category":"external_commands","line_end":42,"severity":"medium","line_start":42},{"id":"blocker:SKILL.md:3:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"description: \"Build robust, production-grade backtesting systems that avoid common pitfalls and prod","category":"blocker","line_end":3,"severity":"low","line_start":3},{"id":"blocker:SKILL.md:11:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"Build robust, production-grade backtesting systems that avoid common pitfalls and produce reliable s","category":"blocker","line_end":11,"severity":"low","line_start":11},{"id":"blocker:SKILL.md:38:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- Avoid providing financial or investment advice.","category":"blocker","line_end":38,"severity":"low","line_start":38},{"id":"blocker:SKILL.md:17:network-reconnaissance","file":"SKILL.md","pattern":"Network reconnaissance","snippet":"- Validating strategy performance and robustness","category":"blocker","line_end":18,"severity":"low","line_start":17}],"finding_verdicts":[{"id":"scripts:resources/implementation-playbook.md:403:dynamic-function-constructor","reason":"The line documents a Python callable parameter in a docstring. It does not invoke a dynamic function constructor or execute generated code.","verdict":"false_positive","confidence":0.99},{"id":"sensitive:resources/implementation-playbook.md:448:certificate-key-files","reason":"The code calls the standard dictionary keys method on a parameter grid. It does not reference certificate files, private keys, or secret material.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:263:system-reconnaissance","reason":"This comment explains shifting trading signals to prevent look-ahead bias. It contains no system discovery command or reconnaissance instruction.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:443:system-reconnaissance","reason":"This is a Python docstring describing grid search for strategy parameters. It performs no operating system or environment reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:resources/implementation-playbook.md:630:system-reconnaissance","reason":"The line recommends point-in-time financial data to avoid look-ahead bias. It does not inspect the host system or collect system details.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:33:ruby-shell-backtick-execution","reason":"The backticks are Markdown formatting around a relative documentation path. The instruction only asks the agent to open that file and contains no shell execution.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:42:ruby-shell-backtick-execution","reason":"The backticks format a resource filename in Markdown. There is no Ruby code, command substitution, or external process invocation.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:3:system-reconnaissance","reason":"This frontmatter description states the skill purpose. It contains no request to inspect system properties, files, users, or processes.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:11:system-reconnaissance","reason":"This sentence repeats the backtesting purpose in ordinary documentation. It includes no reconnaissance behavior or system command.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:38:system-reconnaissance","reason":"The line is a safety restriction against financial or investment advice. It neither requests nor performs system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:17:network-reconnaissance","reason":"The line describes validating trading strategy performance and robustness. It contains no network scanning, host discovery, or connection attempt.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[],"subject_marketplace_commit_sha":"5a26d1d61d694db29af9b138c661c1981076d9df","subject_content_hash":"501f0fcb323900c30ebf717ad04e1c0ce7aebf93b798e9b08639c3f8ac3c0fad","subject_tree_hash":"0e8d728a21a1652be4c5f3e0b3b6163a213b97ceb723e0391eec12c045215f93","subject_plugin_path":"skills/sickn33/backtesting-frameworks","audit_payload_hash":"96a49730b5f15d03c6e6a6f3f7aafd94","confirmed_risk_level":"safe","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"5a26d1d61d694db29af9b138c661c1981076d9df","contentHash":"501f0fcb323900c30ebf717ad04e1c0ce7aebf93b798e9b08639c3f8ac3c0fad","treeHash":"0e8d728a21a1652be4c5f3e0b3b6163a213b97ceb723e0391eec12c045215f93","pluginPath":"skills/sickn33/backtesting-frameworks","auditPayloadHash":"96a49730b5f15d03c6e6a6f3f7aafd94"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-backtesting-frameworks/audits/5/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"safe","confirmedFindingCount":0,"capabilityReviewCount":0,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}