tqsdk

Warn

Audited by Socket on Sep 17, 2026

2 alerts found:

Anomalyx2
AnomalyLOW
references/strategies_other_p5.md

The fragment is a readable automated futures grid-trading example. It receives market data through TqSdk and submits target-position changes as grid levels are crossed. It does not show malicious supply-chain behavior or data exfiltration. It carries significant operational and financial risk because it can place live orders, and it contains likely grid-state logic errors plus unbounded recursion. It should be tested in simulation and reviewed before live deployment.

Confidence: 98%Severity: 62%
AnomalyLOW
references/api_ref_9_tqsdktqapi_-_框架及核心业务_p3.md

The code appears to be a straightforward trading example that authenticates to tqsdk and submits a buy-to-open order. It contains no evident malicious supply-chain behavior. Real credentials should not be hardcoded, and execution should require explicit safeguards because it can create a real financial position. The displayed code also contains a likely syntax error in the context-manager expression.

Confidence: 98%Severity: 58%
Audit Metadata
Analyzed At
Sep 17, 2026, 01:06 AM
Package URL
pkg:socket/skills-sh/algoderiv%2Fagent-skills%2Ftqsdk%2F@4f06b7389f51b8ac112a119c3478721e5cad3fb5fe6e828216f62d94256630c9