Security audit

JoinQuant Strategy Backtest

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a coherent JoinQuant backtest-code skill, but it needs review because it generates order-capable trading templates and recommends an undocumented JoinQuant content endpoint without clear safeguards.

Review before installing. Use generated strategies as backtest examples unless you deliberately adapt and audit them for simulation or live trading, and avoid automated use of undocumented JoinQuant endpoints unless you have confirmed the platform's terms, authorization requirements, and rate limits.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill provides executable JoinQuant strategy templates that call order placement APIs such as order_target_value, but it does not clearly warn users that generated code can submit trades when run in a live or paper/runtime environment rather than a purely offline example context. In a trading-code generation skill, omission of this warning increases the chance of users deploying generated strategies with real financial consequences, especially because the document emphasizes '可直接复制到聚宽平台运行'.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to omit protective filters, stop-loss logic, ST/new-stock/suspension filtering, and other risk controls by default, while presenting the output as directly runnable strategy code. In the context of automated trading strategy generation, this materially increases the likelihood of unsafe or fragile strategies being deployed without users understanding the operational and financial risks.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file walks through failed anti-bot encounters and then culminates in a successful method for extracting full documentation via an undocumented internal endpoint, including exact requests, headers, node names, and parsing code. In a code-generation/backtesting skill, this materially increases the likelihood that the agent or user will operationalize unsupported scraping behavior against a third-party service, potentially violating terms or triggering blocking and account risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document explicitly instructs users to call an internal AJAX endpoint with crafted headers to retrieve content outside the normal documented/browser access path, and frames it as the preferred solution. Even if the content is publicly readable, this guidance encourages bypassing intended access patterns and omits any warning about platform terms, rate limits, or authorization expectations, which can normalize scraping of undocumented interfaces.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file is named README.en.md, but the primary description line is written in Chinese and does not indicate that the skill is Chinese-only or provide an English alternative. This can violate language/locale expectations because it imposes a language choice without user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill README is written entirely in Chinese and presents the skill as the default interface and usage mode, with no indication that users may choose another language. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicit and justified.
Content: No source excerpt is available for this finding.