The Agent Skills Directory

[CREDENTIALS_SAFE]: The skill explicitly avoids hardcoding credentials. It instructs users to store sensitive information like email and password in environment variables (BRAIN_EMAIL, BRAIN_PASSWORD) and reads them at runtime using the wq_common.py utility. This follows industry-standard secret management practices.
[DATA_EXFILTRATION]: Network operations are scoped to the official WorldQuant BRAIN API (api.worldquantbrain.com). These operations are necessary for the skill's primary function of factor research and submission. No evidence of unauthorized data transfer or access to sensitive local files (e.g., SSH keys, AWS credentials) was found.
[COMMAND_EXECUTION]: The skill includes Python scripts (bootstrap.py, mine.py, submit_daily.py, check_score.py) designed to be executed by the user. These scripts are transparent, well-documented, and limit their file system operations to a local wq_workspace/ directory for caching and logging.
[INDIRECT_PROMPT_INJECTION]: The skill ingests structured JSON data from external API responses. While this constitutes an input surface, the skill processes technical metrics (Sharpe, Fitness, PnL records) rather than executing natural language instructions from these inputs. The risk is considered low and inherent to the intended use case.
[REMOTE_CODE_EXECUTION]: There is no evidence of downloading and executing remote scripts or unverified binary payloads. The skill relies on standard, well-known Python packages (requests, numpy).
[PRIVILEGE_ESCALATION]: No operations requiring elevated privileges (e.g., sudo) or modifications to system-level configurations were detected.

wq-challenge-gold-week