wqo-mine
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/wqo.shscript downloads thewqopackage from the official PyPI registry (pypi.org) using a pinned version (0.1.1).\n- [COMMAND_EXECUTION]: The skill uses a shell script to invoke CLI commands. The script enforces a restrictiveumask 077, ensuring that environment files and logs are private to the user.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from WorldQuant BRAIN which may contain untrusted strings. While the surface exists, it is mitigated by explicit safety instructions.\n - Ingestion points: Mining results and dataset exploration data processed in
SKILL.md.\n - Boundary markers: Instructions in
runtime.mdrequiring manual user confirmation for submission and prohibiting the agent from reading credential files.\n - Capability inventory: Simulation and submission of data via the
wqoCLI.\n - Sanitization: Relies on manual human review of all candidates before submission.
Audit Metadata