quant-buddy-skill
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches market data, financial indicators, and configuration from the official
quantbuddy.cnAPI. It optionally interacts withapi.bochaai.comfor web search capabilities during event studies. - [REMOTE_CODE_EXECUTION]: Implements a self-update mechanism in
scripts/self_update.pyand a companion manager inscripts/companion_manager.py. These scripts download verified ZIP packages from the vendor to update skill instructions and logic. The process includes SHA-512 integrity checks and path traversal protection. - [COMMAND_EXECUTION]: Uses a dispatcher pattern in
scripts/call.pyto execute a localexecutor.pyscript via the Python interpreter. Thecompanion_manager.pyscript may utilizepowershell.exeon Windows to create directory junctions for linking companion skills. - [DYNAMIC_EXECUTION]: Supports runtime replacement of its own Python scripts and Markdown instruction files through the built-in update functionality when mandated by the vendor's API response.
Audit Metadata