Security audit

一周拿下 WorldQuant 因子挑战金牌(AI 辅助)

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its WorldQuant BRAIN automation purpose, but it needs Review because it handles primary account credentials and account-affecting submissions while some docs give unsafe or conflicting guidance.

Install only from a reviewed, pinned source if possible. Do not store your BRAIN password in plaintext project files; prefer environment variables or a secure OS credential store. Run the scripts in a dedicated workspace, keep wq_workspace private, and verify that every /submit action asks for explicit confirmation before proceeding.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: README.md:41
Finding: Unpinned third-party installation creates supply-chain exposure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/01-rules-and-scoring.md:44
Finding: Documentation recommends plaintext storage of primary account credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: references/04-submission-harvest.md:138
Finding: Daily-harvest pseudocode bypasses the declared human confirmation boundary
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/01-rules-and-scoring.md (reported line 44)May include surrounding context.

API Base：https://api.worldquantbrain.com

认证方式：HTTP Basic（账号=邮箱，密码=登录密码）打到 /authentication，拿到会话后复用。

⚠️ 凭证安全铁律：永远不要把邮箱/密码硬编码进代码或提交进 Git。放进环境变量或本地 credentials.json（加进 .gitignore）。下面示例演示"从外部读取、不落盘明文进代码"的正确姿势。

python
# auth_example.py —— 通用认证示例（凭证从环境变量读取，绝不硬编码）

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx skills add dfkai/wq-challenge-gold-skill without pinning a specific package version or commit. This creates a supply-chain risk: users may fetch whatever version is current at install time, and if the package or its distribution path is compromised, arbitrary code could be executed in the user's environment.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to use environment variables, read/write workspace files, and access networked APIs, but it declares no explicit tool scope or permission boundaries. In an agent ecosystem, that mismatch can cause over-broad execution authority, making it easier for the skill to access credentials, modify files, or send unintended requests without clear least-privilege constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description says the skill is also for '中文 requests', which hard-codes a language-specific activation scope in natural language. There is no accompanying statement that users may choose another language or that Chinese handling is optional, which can violate language/locale choice policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all user-facing instructions in Chinese and does not provide an opt-in, alternative language, or a documented justification for restricting the skill to that language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file presents all user-facing instructions in Chinese and does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill chapter is written in Chinese and does not indicate any option for alternative languages or user-selected locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file title and the entire instructional content are written in Chinese, and the document presents itself as a reusable core method for broad use rather than a clearly region-specific tool. There is no indication that users may choose another language or that the Chinese-only constraint is required by the skill's purpose.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/06-five-day-plan.md (reported line 68)May include surrounding context.
md
S = requests.Session() # ① 凭证只从环境变量读,绝不硬编码 S.auth = (os.environ["BRAIN_EMAIL"], os.environ["BRAIN_PASSWORD"]) S.post("https://api.worldquantbrain.com/authentication") # ② 拉字段/算子地图,落盘 fields = S.get("https://api.worldquantbrain.com/data-fields").json()

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/06-five-day-plan.md (reported line 71)May include surrounding context.
md
S = requests.Session() # ① 凭证只从环境变量读,绝不硬编码 S.auth = (os.environ["BRAIN_EMAIL"], os.environ["BRAIN_PASSWORD"]) S.post("https://api.worldquantbrain.com/authentication") # ② 拉字段/算子地图,落盘 fields = S.get("https://api.worldquantbrain.com/data-fields").json()

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/06-five-day-plan.md (reported line 72)May include surrounding context.
md
S = requests.Session() # ① 凭证只从环境变量读,绝不硬编码 S.auth = (os.environ["BRAIN_EMAIL"], os.environ["BRAIN_PASSWORD"]) S.post("https://api.worldquantbrain.com/authentication") # ② 拉字段/算子地图,落盘 fields = S.get("https://api.worldquantbrain.com/data-fields").json()

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/06-five-day-plan.md (reported line 76)May include surrounding context.
md
S = requests.Session() # ① 凭证只从环境变量读,绝不硬编码 S.auth = (os.environ["BRAIN_EMAIL"], os.environ["BRAIN_PASSWORD"]) S.post("https://api.worldquantbrain.com/authentication") # ② 拉字段/算子地图,落盘 fields = S.get("https://api.worldquantbrain.com/data-fields").json()

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/06-five-day-plan.md (reported line 89)May include surrounding context.
md
S = requests.Session() # ① 凭证只从环境变量读,绝不硬编码 S.auth = (os.environ["BRAIN_EMAIL"], os.environ["BRAIN_PASSWORD"]) S.post("https://api.worldquantbrain.com/authentication") # ② 拉字段/算子地图,落盘 fields = S.get("https://api.worldquantbrain.com/data-fields").json()

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The example simulation hard-codes the region to "USA" in the skill instructions, and elsewhere the chapter frames non-USA regions as unavailable rather than offering a user choice. This is a natural-language locale constraint presented as the default workflow without opt-in or documented justification tied to a region-specific compliance purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill description is written in Chinese and does not indicate that another language is available or that the user may choose their preferred language. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains its primary docstring, usage guidance, and many operational messages exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire template is written as mandatory instructional content in Chinese, and it does not indicate that another language may be used. This can violate a language/locale policy when a skill imposes a specific language without explicit user choice or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing instructional content exclusively in Chinese, with no note that the language is optional or targeted to a specific locale. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.