worldquant-miner-cn

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:52 PM UTC
• Version: 1.0.0

Overview

This documentation-only skill is purpose-aligned, but it asks users to expose WorldQuant account credentials and enables unattended account submissions with weak safeguards.

Review before installing. Use this only with an account you are comfortable automating, avoid storing real passwords in credential.txt or command-line arguments, prefer a secret manager or tightly permissioned file outside the repo, and do not enable continuous submission unless you understand the WorldQuant account, quota, and policy consequences.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:11

Finding

WorldQuant Credentials Stored in an Unprotected Plaintext File

Content

View full analysis

Vulnerability Details

File Location: README.md:11-13
Additional Locations: SKILL.md:44-47, references/README_en.md:145-150
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Configure credentials
echo '["email", "password"]' > credential.txt

The equivalent instructions in SKILL.md are:

bash

# Create credential file
echo '["[e-mail]", "your_password"]' > credential.txt

The reference documentation also directs users to create the following file:

json

["[e-mail]", "your_password"]

Technical Analysis

The documented setup procedure writes a WorldQuant email address and password directly into an unencrypted file. It does not instruct the user to restrict file permissions, exclude the file from source control, use a secret manager, or remove the file after use.

The network use of these credentials for authentication with the WorldQuant platform is consistent with the Skill's declared simulation and submission functionality. No evidence was found that the credentials are deliberately transmitted to an unrelated third party. The vulnerability instead concerns excessive local exposure before the legitimate authentication request occurs.

A plaintext credential file may be accessible to other local users or processes depending on the working directory and process umask. It can also be captured by source-control commits, backups, support bundles, container build contexts, or broadly mounted Docker volumes.

Attack Path

1. A user follows the documented setup procedure and creates credential.txt.
2. The password remains stored as plaintext in the project directory.
3. The file is exposed through permissive filesystem permissions, a repository commit, a backup, a container build context, a shared volume, or another local process.
4. An attacker reads the email ...[truncated 791 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not instruct users to store account passwords directly in the project directory.
2. Prefer an operating-system credential store, a dedicated secret manager, or Docker secrets.
3. If file-based credentials are unavoidable:
   • Create the file with permissions limited to its owner, such as mode 0600.
   • Store it outside the source tree.
   • Mount it read-only into the container.
   • Ensure it is never copied into an image layer.
4. Add credential.txt and equivalent secret files to .gitignore and .dockerignore.
5. Document credential rotation and immediate revocation procedures.
6. Avoid examples that place real secrets directly in shell commands, since shell history may retain the command.
7. Prefer short-lived tokens or narrowly scoped platform credentials if WorldQuant supports them.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/README_en.md:444

Finding

Password Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: references/README_en.md:444
Additional Location: references/README_en.md:462
Vulnerability Type: Sensitive information exposed in process arguments and shell history
Risk Level: Medium

Vulnerable Code Snippet:

bash

python machine_miner.py --username your_worldquant_username --password your_worldquant_password

The same command is repeated in the Consultant usage instructions:

bash

python machine_miner.py --username your_worldquant_username --password your_worldquant_password

Technical Analysis

Supplying a password through a command-line option exposes it beyond the minimum scope required for authentication. Depending on the operating system and environment, command arguments may be visible through process-inspection utilities, process telemetry, audit systems, job logs, crash reports, terminal recording, and shell history.

Authentication with WorldQuant is necessary for the declared functionality, but exposing the password through the process command line is not necessary. A secure prompt, protected secret file descriptor, secret manager, or equivalent mechanism can provide the credential without placing it in globally observable arguments.

Attack Path

1. A user replaces the placeholder with a real password and executes the documented command.
2. The shell records the command in history, or the operating system exposes the active process arguments.
3. Another authorized local user, monitoring agent, log collector, or attacker with access to the history or telemetry reads the password.
4. The attacker authenticates to the WorldQuant account.
5. The attacker performs actions permitted to the compromised account.

Exploitation depends on access to local process information, shell history, or collected telemetry. No executable implementation was included in the artifact, so no separate argument-parsing or command-injection behav ...[truncated 467 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --password command-line option from the documented workflow.
2. Prompt interactively using a non-echoing facility such as Python's getpass.
3. For automated operation, retrieve the password from an operating-system credential store, secret manager, or Docker secret.
4. If environment variables must be supported, document that they may still be exposed through diagnostics and should only be used in controlled environments.
5. Ensure application logs redact passwords, authorization headers, session cookies, and tokens.
6. Recommend clearing any shell history containing previously used passwords and rotating credentials that may already have been exposed.
7. Prefer short-lived, revocable, and least-privileged authentication tokens where supported.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (18)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The explicit use of a file named credential.txt containing raw login credentials indicates credential material is expected to exist unencrypted on disk. Given this project's purpose is automated alpha generation, testing, and submission, compromise of that file could grant unauthorized access to the linked WorldQuant account and enable account abuse, data access, or fraudulent submissions.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

bash

# 配置凭据
echo '["email", "password"]' > credential.txt

# 启动
docker-compose -f docker-compose.gpu.yml up -d

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

This line contains an explicit example that writes a username and password to credential.txt in plaintext. It normalizes unsafe secret handling and creates a clear path for credential theft if the file is read by other users, malware, logs, backups, or accidentally committed to source control.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

bash

# 创建凭据文件
echo '["[e-mail]", "your_password"]' > credential.txt

2. 启动系统

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Referencing credential_path="credential.txt" in usage examples reinforces the insecure pattern of keeping reusable credentials in a plaintext file on disk. In the context of an automated trading-related tool and local dashboard/docker deployment, this increases the chance the secret file will be mounted, copied, or mishandled across components.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

# 初始化
generator = AlphaGenerator(
    model="llama3.2:3b",
    credential_path="credential.txt"
)

# 生成 Alpha

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This submission example again depends on credential_path="credential.txt", extending the same insecure storage practice into account actions that may submit trades or strategies. Because submission functionality is sensitive, compromise of these credentials could enable unauthorized use of the WorldQuant account and abuse of limited submission quotas.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

python

from worldquant_miner import AlphaSubmitter

submitter = AlphaSubmitter(credential_path="credential.txt")

# 提交成功的 Alpha
submitter.submit_best(

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

1. **每日限制** - WorldQuant 每天只能提交一次
2. **相关性测试** - 提交前检查相关性
3. **凭据安全** - 不要提交 credential.txt
4. **资源消耗** - GPU 推理需要显存

## 相关链接

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The quick-start flow tells users to set up credentials in credential.txt, encouraging secret storage in a predictable plaintext file. Predictable local secret files are high-risk because they are easily leaked through version control mistakes, container mounts, support bundles, or malware on the host.

Content

Scanner excerpt · references/README_en.md (reported line 20)May include surrounding context.

Quick Start:

bash

cd naive-ollama
# Setup credentials in credential.txt
docker-compose -f docker-compose.gpu.yml up -d
# Access dashboard at http://localhost:5000

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/README_en.md (reported line 27)May include surrounding context.

---

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

This section provides a concrete example containing the exact plaintext credential format users should create, making insecure handling explicit and easy to follow. Such guidance materially increases the chance that sensitive account credentials are stored unsafely and later exposed.

Content

Scanner excerpt · references/README_en.md (reported line 147)May include surrounding context.

1. Setup Credentials

Create naive-ollama/credential.txt with your WorldQuant Brain credentials:

json

["[e-mail]", "your_password"]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Listing credential.txt as a normal project file further legitimizes storing credentials inside the project directory. While this line alone is documentation, in context it reinforces an insecure secret-management pattern across the project.

Content

Scanner excerpt · references/README_en.md (reported line 237)May include surrounding context.

md

├── docker-compose.gpu.yml         # GPU-enabled deployment
├── docker-compose.yml             # CPU-only deployment
├── requirements.txt               # Python dependencies
├── credential.txt                 # WorldQuant credentials
├── start_gpu.bat                  # Windows GPU startup script
├── start_dashboard.bat            # Windows dashboard startup script
├── README.md                      # Detailed documentation

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The usage example shows the application loading credentials from ./credential.txt, confirming operational dependence on a plaintext secret file. This demonstrates that the insecure storage pattern is not merely incidental documentation but part of the expected workflow.

Content

Scanner excerpt · references/README_en.md (reported line 340)May include surrounding context.

md

-rank(combined_score)
2025-05-04 01:37:50,111 - INFO - Output file: mined_expressions.json
2025-05-04 01:37:50,112 - INFO - Initializing AlphaExpressionMiner
2025-05-04 01:37:50,112 - INFO - Loading credentials from ./credential.txt
2025-05-04 01:37:50,112 - INFO - Authenticating with WorldQuant Brain...
2025-05-04 01:37:51,303 - INFO - Authentication response status: 201
2025-05-04 01:37:51,303 - INFO - Authentication successful

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README explicitly instructs users to place an email/password pair into a plaintext file, with no warning about file permissions, exclusion from version control, or safer secret storage. In a system that performs automated testing and submission, these credentials are likely privileged and could be exposed through local compromise, shell history, backups, mounted Docker volumes, or accidental repository commits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs users to place a WorldQuant email and password into a local plaintext file. Plaintext credential storage is dangerous because the file can be exposed through shell history, backups, accidental commits, weak filesystem permissions, container mounts, or other local compromise, directly enabling account takeover.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The package metadata uses Chinese in the description and includes a China-specific keyword, which suggests the skill is oriented to a specific language/locale. The file does not indicate that this is an optional user-selected locale or that the restriction is explicitly justified as region-specific, so it may violate the language/locale policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation promotes fully automated 24/7 generation and submission against a user account without clearly warning about unattended external actions. In a system that can test and submit to a third-party platform, this can cause unintended account activity, policy violations, or financial/reputational harm if left running unsupervised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README explicitly instructs users to place WorldQuant credentials in a plaintext file and even shows the expected format. This normalizes insecure secret handling, increasing the likelihood of credential theft through accidental commits, backups, shared volumes, or local compromise.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/README_en.md (reported line 768)May include surrounding context.

2. Creating Mining Tasks

python

# Create a new mining task
response = requests.post(
    f"{API_URL}/api/v1/mining/tasks",
    headers=headers,
    json={

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The natural-language instructions and labeling are entirely in Chinese, and the file does not indicate that this locale restriction is optional or required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in can be a language or locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description, instructions, and operational guidance are presented exclusively in Chinese, while the file does not indicate that the skill is intentionally limited to Chinese-speaking users or provide an opt-in language choice. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.