tqx

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the subprocess.run module in server.py and agent.py to interface with the tqx and tqx-cli binaries. These calls are correctly implemented using list-based arguments to prevent command injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill retrieves Markdown documentation and API references from the official TQX Git repository (cnb.cool). These downloads are restricted to static documentation used for grounding the agent's knowledge and do not include executable scripts or binaries.
  • [CREDENTIALS_UNSAFE]: The skill implements safe credential management by instructing the agent to use request_env_input for collecting TQX credentials and managing sessions via local configuration files, avoiding exposure in chat history.
  • [SAFE]: The 'Studio' companion UI is a local workbench that persists data (backtests, strategies, and journals) to the persistent workspace directory. It uses a standard Python HTTP server to proxy requests to the local TQX CLI tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 10:41 PM
Security Audit — agent-trust-hub — tqx