akquant
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the
uvinstallation script from Astral's official domain (astral.sh) using shell piping and PowerShell. These are documented installation methods for the well-known developer tool. - [PRIVILEGE_ESCALATION]: Recommends the use of the
-ExecutionPolicy ByPassflag in PowerShell to facilitate the installation of package management tools on Windows systems. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-defined quantitative strategy requirements to generate executable code, creating a potential injection surface.
- Ingestion points: User requirements for trading strategies, indicators, and risk parameters defined in the 'Stage One' workflow of
SKILL.md. - Boundary markers: No explicit delimiters or warnings to ignore instructions within the user-provided data are implemented in the generation logic.
- Capability inventory: The generated code and environment commands allow for shell execution (
uv run) and local filesystem operations. - Sanitization: No sanitization or validation of user-provided strategy logic is specified before incorporation into the final executable code.
Recommendations
- HIGH: Downloads and executes remote code from: https://astral.sh/uv/install.sh - DO NOT USE without thorough review
Audit Metadata