rqams

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs necessary tools from public package registries, specifically @ricequant2026/rqams-cli via npm and rqamsc via pip. These packages are part of the official vendor infrastructure and are required for the skill's functionality.
  • [COMMAND_EXECUTION]: The skill executes local commands to manage financial data, including initializing internal document caches via scripts/init_skill.py and interacting with the rqamsc command-line interface.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external financial data such as valuation tables, position statements, and custodian events which could potentially contain malicious instructions. However, the skill mitigates this risk by defining explicit reconciliation and event workflows that mandate user confirmation for all critical actions and data writes.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 10:40 AM
Security Audit — agent-trust-hub — rqams