quant-buddy-skill

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to extract user-provided API keys beginning with "sk-", write them into config.json via a file-write operation, and then call tools/sessions using that key—forcing the LLM to include the secret verbatim in generated tool/command payloads (high exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill includes an explicit web-search/news step (calls to api.bochaai.com / "Bocha" in references/scripts-audit.md and SKILL.md) and event-study recipes (e.g., recipes/event-study-formulas.md Step D2 and scripts/event_study_local.py) that instruct the agent to fetch and interpret public third‑party web content and use those labels to drive grouping and downstream formula execution, which meets the criteria for indirect prompt injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill includes a runtime self-update path (scripts/self_update.py and SKILL.md) that will download and install a server-provided zip (zip_url) — e.g. a URL under the quant-buddy update flow such as https://www.quantbuddy.cn/.../quant-buddy-skill.zip — which is fetched and applied at runtime to replace/execute skill code, so it is a high-confidence risky external dependency.