wtpy
Warn
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: Documentation hardcodes default credentials for the monitoring console component. Evidence found in 'references/tools-console.md' and 'references/getting-started-notes.md'.
- [EXTERNAL_DOWNLOADS]: Users are directed to download setup binaries and datasets from Baidu Pan, an unverified generic file hosting service. Evidence found in 'references/advanced.md' and 'references/strategies.md'.
- [COMMAND_EXECUTION]: Instructions recommend insecure file permission settings ('chmod 777') for build scripts on Linux, documented in 'references/wtcpp-modules.md'.
- [INDIRECT_PROMPT_INJECTION]: The framework ingests untrusted CSV data using 'pd.read_csv' without sanitization or boundary markers. 1. Ingestion points: 'references/advanced.md', 'references/data-management.md', 'references/data-tools.md'. 2. Boundary markers: Absent (no delimiters or directions to ignore embedded instructions). 3. Capability inventory: High (network trading execution, file system access, server execution). 4. Sanitization: Absent (no evidence of validation or filtering applied to external content).
Audit Metadata