wqo-analyze
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the
wqopackage version 0.1.1 from the official Python Package Index (PyPI). This is a standard installation procedure for the tool's functionality. - [COMMAND_EXECUTION]: The skill utilizes a shell script (
scripts/wqo.sh) to manage environment setup and execute CLI commands. The script follows security best practices, such as setting a restrictiveumask(077) and performing version verification before execution. - [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from the external WorldQuant BRAIN platform via CLI output. This represents a potential surface for indirect prompt injection if the external service returns malicious content.
- Ingestion points: CLI output from
wqocommands as described inSKILL.md. - Boundary markers: The skill provides a structured interpretation guide for metrics (Sharpe, Fitness, Turnover) which acts as a logical boundary.
- Capability inventory: Execution of shell commands via the
scripts/wqo.shwrapper script. - Sanitization: No explicit automated sanitization is performed on the tool's output before the agent processes it.
Audit Metadata