wqo-data

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes a shell script (scripts/wqo.sh) to download and install the wqo package (version 0.1.1) from the official Python Package Index (PyPI) if it is not already present in the environment.
  • [COMMAND_EXECUTION]: The skill's primary function is to execute shell commands through a bundled runner script to interact with the WorldQuant BRAIN platform.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from the WorldQuant BRAIN API (datasets, fields, and operators), creating a surface for potential indirect prompt injection from external API responses.
  • Ingestion points: CLI output from wqo data datasets, wqo data fields, and wqo data operators commands.
  • Boundary markers: references/runtime.md defines strict operational boundaries, including instructions to ignore credentials and maintain quotas.
  • Capability inventory: Subprocess execution of the wqo CLI tool via bash.
  • Sanitization: No specific sanitization or validation of the API-provided data strings is mentioned before they are processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 07:49 AM