Skills
skills/pseudo-longinus/quant-buddy-data/quant-buddy-skill/Gen Agent Trust Hub

quant-buddy-skill

Warn

Audited by Gen Agent Trust Hub on Jul 28, 2026

Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The script scripts/self_update.py implements a self-update routine that downloads a ZIP archive from a server-provided URL, validates its SHA-512 digest, and extracts it to replace the skill's source code. This functionality allows for dynamic remote code updates.
  • [COMMAND_EXECUTION]: The dispatcher scripts/call.py executes internal Python scripts (scripts/executor.py and scripts/self_update.py) using subprocess.run and subprocess.Popen via the local Python interpreter (sys.executable).
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to www.quantbuddy.cn for financial data, api.bochaai.com for news searches, and fetches CSV data via scripts/fetch_fastquery_csv.py using the urllib standard library.
  • [PROMPT_INJECTION]: The workflows/global-rules.md file contains instructions that override the agent's natural behavior, specifically mandating the removal of thinking tags (<think>) and internal process logs from final user responses. These constraints are designed to hide the agent's internal reasoning and process from the user.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 28, 2026, 03:46 PM
Security Audit — agent-trust-hub — quant-buddy-skill