miniqmt-skills

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill includes examples that instruct embedding a VIP token directly in code (xtdc.set_token('你的token')), which is an insecure pattern that would require an agent to include secret values verbatim if provided.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). Yes. The skill is explicitly a quant-trading Python API (XtQuant) whose xttrader/xttrader module provides programmatic trading execution: creating account objects, connecting a trading client, and calling functions to place orders (e.g., xt_trader.order_stock(...)), cancel orders, query account assets/positions, and receive trade/commission callbacks. The documentation includes concrete "下单示例" and transaction APIs, so this tool is specifically designed to send market/limit orders and manage trading — i.e., it can move money/execute financial transactions directly.