buffett-moat-screener

This module is primarily a backtesting/orchestration pipeline and does not show overt malicious behavior (no explicit exfiltration, shell execution, or credential theft in this fragment). However, it introduces high-impact supply-chain/sabotage risk via unsafe pickle deserialization of checkpoint/preliminary state (including an optionally user-supplied reuse-preliminary path) and via runtime sys.path insertion that can enable module shadowing. If attackers can influence the filesystem artifacts or import path environment, arbitrary code execution is plausible. Recommended mitigations: avoid pickle for untrusted artifacts (use signed/validated formats), restrict/load only from trusted directories, verify file integrity before loading, and remove/limit sys.path modifications.

No explicit malicious payload is present in this wrapper code (no eval/exec/subprocess/network calls shown, no hardcoded credentials). The primary risk is supply-chain/host-compromise: it executes repository-controlled Python by inserting a runtime-supplied path into sys.path and importing modules from it, and it passes plaintext credentials from stdin into those imported modules. Treat the repository path and its panda_adapter/build/validation modules as fully trusted only after verification; otherwise this design can enable credential theft, unauthorized network actions, or sabotage implemented in the imported code.