rqams
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs necessary tools from public package registries, specifically
@ricequant2026/rqams-clivia npm andrqamscvia pip. These packages are part of the official vendor infrastructure and are required for the skill's functionality. - [COMMAND_EXECUTION]: The skill executes local commands to manage financial data, including initializing internal document caches via
scripts/init_skill.pyand interacting with therqamsccommand-line interface. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external financial data such as valuation tables, position statements, and custodian events which could potentially contain malicious instructions. However, the skill mitigates this risk by defining explicit reconciliation and event workflows that mandate user confirmation for all critical actions and data writes.
Audit Metadata