rqdata-python

This is a documentation cache and downloader with no evident malware, credential theft, or hidden execution. Its main security concerns are path traversal through document_name, output_name, and csv_name, and unrestricted URLs passed to curl, including links sourced from downloaded documentation; these can cause unintended file access or network requests if those inputs are attacker-controlled. The hardcoded service URL is https://www.ricequant[.]com/doc/document-index.txt. Severity is moderate and depends on whether callers or downloaded documents are untrusted.