tqx

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The code intentionally sends internal tool outputs (account state, positions, backtest results, etc.) into an external LLM endpoint (openrouter.ai) as part of the agent loop, and the server exposes/echoes auth info with permissive CORS and persistent config syncing — enabling data exfiltration of sensitive trading/account data.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In templates/studio/server.py, the runtime path /api/agent/chat accepts outsider-authored history from the client and passes it directly into tqx_agent.run_agent_turn(...), which in templates/studio/agent.py builds messages and sends them to the LLM (via proxied_post(LLM_URL, ...)) for tool-calling.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The agent posts user/system messages at runtime to the external LLM endpoint https://openrouter.ai/api/v1/chat/completions (defined as LLM_URL in templates/studio/agent.py) whose responses (tool_calls/content) directly drive the agent's actions and cause execution of local CLI commands.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly includes trading/order-placement capabilities. It references a dedicated trading CLI ("tqx-trading") with "authorized order placement", shows authenticated CLI login flow, and contains concrete order APIs/usage (order_shares in strategy code, an automation loop step "place order", and guidance for live vs PAPER accounts and idempotency). These are specific market-order execution tools (buy/sell orders), so this grants direct financial execution authority.