stock-quant

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
  • [COMMAND_EXECUTION]: The skill relies on the longbridge CLI tool to perform various market data operations, including fetching K-line data, trade history, index constituents, and portfolio positions.
  • [EXTERNAL_DOWNLOADS]: The skill instructions prompt for the installation of standard, well-known Python packages from public registries, such as pandas, numpy, scikit-learn, statsmodels, and arch, to support its analytical capabilities.
  • [DYNAMIC_EXECUTION]: It involves generating and recommending the execution of Python code for statistical tests (ADF, GARCH, OLS), machine learning model training (Random Forest, Gradient Boosting), and walk-forward optimization.
  • [REMOTE_CODE_EXECUTION]: The quant run command facilitates the execution of indicator scripts on a remote server, which is a core feature of the supported quantitative analysis platform.
  • [DATA_EXFILTRATION]: The skill provides instructions for accessing potentially sensitive portfolio data via the longbridge positions command, which is a required step for its hedging strategy framework and relies on established authentication mechanisms.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes market data and index constituent lists. This ingestion of external data constitutes a surface for indirect prompt injection, although the numerical nature of the data significantly limits the risk.
  • [METADATA_POISONING]: The skill metadata identifies longbridge as the author, which differs from the system-provided author handle. While this could be misleading, the technical content is consistent with the legitimate Longbridge financial services ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 01:13 AM