wqo-alphas

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/wqo.sh script installs the wqo package (version 0.1.1) from PyPI into a project-local virtual environment if the command is not found on the system.
  • [COMMAND_EXECUTION]: The skill interacts with the local environment by executing shell commands through a Bash runner that wraps the wqo CLI tool.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes alpha metadata from the WorldQuant BRAIN platform. The ingestion occurs through alpha listing commands, while risk is mitigated by explicit instructions to never access credentials files, require user confirmation for all submissions, and check metadata for tool labels before performing write operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 07:49 AM