miniqmt-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow uses miniqmt-cli stream tick|kline|order which ingests tick/order event payloads emitted by the Windows FastAPI daemon (ultimately from xtquant/broker data), and those event fields are treated as readable JSON text in the agent’s LLM context—this is outsider-authored market/broker content not authored by the operating user.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is a command-line trading client explicitly built to place and manage broker orders and account-level actions. It documents commands to submit market/limit orders (order buy / order sell), cancel orders, stream order lifecycle events, place market orders via a POST /trade/order endpoint (idempotency client_req_id), and even reset risk breakers for accounts. These are direct, specific financial-execution operations (market orders, cancels, risk reset on live/sim accounts), not generic tooling. Therefore it grants direct financial execution authority.