tdxquant
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
_tdx_init.pyscript executes thewmicsystem utility viasubprocess.runto locate the executable path of theTdxW.exeprocess. This is used solely for the benign purpose of automatically discovering the terminal's installation directory to load the requiredtqcenterlibrary. - [INDIRECT_PROMPT_INJECTION]: The skill ingests market data, financial indicators, and securities metadata (e.g., company names, financial field values) from external market data servers via the terminal's API. This content is returned to the agent context without explicit sanitization or boundary markers, which is a standard surface for indirect prompt injection common in financial data skills. Evidence found in
market_data.pyandfinancial_data.py. - [COMMAND_EXECUTION]: The
formula.pyscript enables the execution of TongDaXin technical analysis formulas (DSL) such as MACD or KDJ through the localtqcenterlibrary as part of its core technical analysis functionality.
Audit Metadata