wqo-alphas
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/wqo.shscript installs thewqopackage (version 0.1.1) from PyPI into a project-local virtual environment if the command is not found on the system. - [COMMAND_EXECUTION]: The skill interacts with the local environment by executing shell commands through a Bash runner that wraps the
wqoCLI tool. - [INDIRECT_PROMPT_INJECTION]: The skill processes alpha metadata from the WorldQuant BRAIN platform. The ingestion occurs through alpha listing commands, while risk is mitigated by explicit instructions to never access credentials files, require user confirmation for all submissions, and check metadata for tool labels before performing write operations.
Audit Metadata