Quant Research Platform

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:12 PM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned as a quant research toolkit, but it materially overstates its finance capabilities and can produce mocked random factor data without clear user-facing disclosure.

Review this before installing or relying on results. Treat it as a prototype or demo unless the documentation is corrected, mocked financial factors are removed or clearly labeled, dependencies are pinned, and any market or alternative-data integrations are explicitly documented with data-source, privacy, and licensing controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55–56
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code:

bash

pip install pandas numpy scikit-learn xgboost lightgbm scipy statsmodels
pip install akshare tushare

Technical Analysis

The documented installation commands install multiple packages without fixed versions or cryptographic integrity hashes. Consequently, the exact code installed depends on package-index contents and dependency resolution at installation time.

This makes installations non-reproducible and creates exposure to compromised package releases, malicious transitive dependencies, dependency-resolution changes, or an untrusted package index. Python packages may execute installation-related code, and imported packages execute module initialization code. A compromised dependency could therefore run attacker-controlled code in the user's environment.

The audit did not identify evidence that any currently named package is malicious. The vulnerability is the absence of controls ensuring that users receive specifically reviewed package artifacts.

Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, or a package index used by the victim.
2. The attacker publishes or serves a malicious release that satisfies the unconstrained dependency request.
3. A user follows the installation instructions in SKILL.md.
4. pip resolves and downloads the attacker-controlled package artifact.
5. Malicious code executes during package installation or when the package is subsequently imported.
6. The payload operates with the privileges and environment access of the user running pip or the research platform.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. Depending on that user's permissions and environment, an attack ...[truncated 440 chars]

Remediation

View remediation

Remediation Suggestions

1. Move direct dependencies into a reviewed requirements or project configuration file and pin each package to an approved version.
2. Generate a lock file that also constrains transitive dependencies.
3. Record and enforce artifact hashes, for example by using:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Retrieve packages only from an approved HTTPS package index or an internally controlled artifact repository.
5. Disable unintended fallback to additional or user-controlled package indexes.
6. Run dependency vulnerability and provenance checks in continuous integration, and update pins through a controlled review process.
7. Install dependencies inside an isolated virtual environment or container under a non-privileged account.
8. Review new package versions before updating the lock file, including changes to transitive dependencies and package ownership.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description is broadly aligned with the quantitative finance domain of the code: it does support multi-factor research concepts, IC/IR-style analysis, factor correlation, backtesting, and portfolio optimization. However, the description materially overstates implemented capabilities. The code defines a small factor library plus support for adding custom factors, not 100+ alpha factors. It lacks any genuine factor mining/discovery system and does not implement an 'intelligent factor combination' module beyond generic portfolio optimization methods. In addition, several fundamental factors are placeholders generated randomly, which weakens the claim of a robust research platform. Therefore, the description does not accurately represent the actual implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly promotes alternative data sources such as satellite data, web traffic, and supply-chain data without warning users that using these features may trigger external data access, data transmission, licensing, privacy, or compliance obligations. In a quant research context, this can lead users to ingest or send sensitive identifiers, proprietary research targets, or regulated data to third-party providers without informed consent or controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description and comments claim a large factor library and realistic quantitative research, but the code implements only a small set of factors and uses randomly generated values for supposed fundamental metrics such as PE, PB, ROE, and ROA. In a financial research and backtesting context, this is dangerous because it can silently produce misleading analysis, false confidence in model performance, and bad downstream trading or allocation decisions based on fabricated data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.