Strategy Deployer

Deploy trading strategies with risk gating, monitoring, and guarded live promotion.

Security Scan

The skill's instructions are coherent with a trading-deployment workflow and it is instruction-only (no installs or secret requests), but there are minor provenance/metadata inconsistencies and the skill is underspecified about how broker/connector credentials are provided — review those before use.

Purpose & Capability

The name, description, and runtime instructions consistently describe a strategy deployment lifecycle (validate → risk-check → paper → monitor → guarded live promote). However, metadata shows inconsistent provenance: registry ownerId (kn74114...) differs from _meta.json ownerId (redhat-agent-001) and SKILL.md author (RedHat Dev). That mismatch doesn't prove maliciousness but is a provenance red flag to verify.

Instruction Scope

SKILL.md stays within the declared purpose: it specifies inputs, explicit risk checks, monitoring, and approval gating for live promotion. It does not instruct the agent to read arbitrary system files, exfiltrate data, or call unexpected endpoints. The content is high-level (no exchange API calls), so the actual side effects depend on how the agent implements deployments.

Install Mechanism

Instruction-only skill with no install spec and no code files; nothing is written to disk or fetched during install. This is the lowest-risk install model.

Credentials

The skill requests no environment variables or credentials, which matches the fact it provides only high-level instructions. However, real paper/live deployments will require broker/exchange credentials and API keys; those are not declared here. Before using the skill in a real environment, confirm how the agent will obtain and protect necessary secrets and ensure the skill cannot be induced to promote live trading without explicit human-controlled credentials and approval.

Persistence & Privilege

always is false and the skill does not request persistent system-wide settings or modify other skills. Autonomous invocation is allowed by platform default; on its own that is not a disqualifier, but you should ensure policies prevent automated live promotions without human approval.

Assessment

This instruction-only skill appears to implement a reasonable, safety-minded trading deployment workflow. Before installing: (1) verify the skill's provenance given inconsistent metadata (registry owner vs _meta.json/author); (2) test thoroughly in an isolated/simulated environment (paper mode) to confirm the agent's actual connectors and order-handling behave as intended; (3) ensure broker/API credentials are supplied and stored securely by your agent platform (the skill itself doesn't declare or manage credentials); (4) enforce a policy that prevents any autonomous live promotion without explicit human approval and audited approval artifacts; and (5) consider requesting the author to clarify triggers in skill.yml (it contains 'System.Object[]') and to align metadata to remove ambiguity. If you cannot confirm provenance or control how credentials and approvals are enforced, treat the skill as higher risk and do not allow live promotions.

SKILL: strategy-deployer

Purpose

Deploy trading strategies safely using an explicit lifecycle: validate → risk-check → paper deploy → monitor → (guarded) live promote → scale/stop.

When to Use

• A strategy is ready after backtesting.
• Moving from research to paper trading.
• Promoting a paper-tested strategy to live trading (guarded).

Inputs

• strategy_spec (required, object|string): rules, signals, markets, timeframes.
• mode (optional, enum: paper|live, default: paper)
• risk_limits (required, object): max risk per trade, max drawdown, exposure caps.
• validation_artifacts (optional, object): backtest report, paper performance stats.
• approval (optional, string): explicit user/Morpheus approval reference for live.

Steps

1. Verify prerequisites:
   • strategy has a written hypothesis and defined invalidation conditions
   • backtest/paper artifacts exist (as applicable)
2. Run risk checks:
   • enforce risk per trade
   • enforce exposure caps
   • enforce max drawdown thresholds
   • ensure kill-switch is configured
3. Deploy to paper (default):
   • start with small allocation
   • emit logs for every signal and order
4. Monitor and record:
   • trades
   • slippage
   • drawdown
   • regime notes
5. Promote to live only if:
   • explicit mode=live
   • explicit approval is present
   • preflight checks pass
6. Define rollback/stop rules and execute them on trigger.

Validation

• Paper mode produces complete logs and trade history entries.
• Live mode is blocked unless approval + flags are present.
• Risk constraints are enforced before every order.
• Stop conditions are tested (kill-switch works).

Output

deployment: "paper|live"
strategy: "<name/id>"
markets: ["..."]
risk_limits: { "...": "..." }
status: "deployed|blocked|stopped"
audit_events: ["signal_detected", "risk_check_passed", "order_submitted", "order_filled", "trade_recorded"]

Safety Rules

• Never bypass risk checks to “capture opportunity”.
• Never deploy live without explicit approval and a paper validation phase.
• Never imply profit certainty; report performance as historical/conditional.

Example

Paper deploy:

• strategy_spec: “Mean reversion in range regime, 5m timeframe.”
• mode: paper
• Output: deployment report + monitoring checklist + stop triggers.