wqo-data
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes a shell script (
scripts/wqo.sh) to download and install thewqopackage (version 0.1.1) from the official Python Package Index (PyPI) if it is not already present in the environment. - [COMMAND_EXECUTION]: The skill's primary function is to execute shell commands through a bundled runner script to interact with the WorldQuant BRAIN platform.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from the WorldQuant BRAIN API (datasets, fields, and operators), creating a surface for potential indirect prompt injection from external API responses.
- Ingestion points: CLI output from
wqo data datasets,wqo data fields, andwqo data operatorscommands. - Boundary markers:
references/runtime.mddefines strict operational boundaries, including instructions to ignore credentials and maintain quotas. - Capability inventory: Subprocess execution of the
wqoCLI tool viabash. - Sanitization: No specific sanitization or validation of the API-provided data strings is mentioned before they are processed by the agent.
Audit Metadata