wqo-analyze

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads the wqo package version 0.1.1 from the official Python Package Index (PyPI). This is a standard installation procedure for the tool's functionality.
  • [COMMAND_EXECUTION]: The skill utilizes a shell script (scripts/wqo.sh) to manage environment setup and execute CLI commands. The script follows security best practices, such as setting a restrictive umask (077) and performing version verification before execution.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data returned from the external WorldQuant BRAIN platform via CLI output. This represents a potential surface for indirect prompt injection if the external service returns malicious content.
  • Ingestion points: CLI output from wqo commands as described in SKILL.md.
  • Boundary markers: The skill provides a structured interpretation guide for metrics (Sharpe, Fitness, Turnover) which acts as a logical boundary.
  • Capability inventory: Execution of shell commands via the scripts/wqo.sh wrapper script.
  • Sanitization: No explicit automated sanitization is performed on the tool's output before the agent processes it.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 07:49 AM