量化策略研发实验室

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:44 PM UTC
• Version: 1.0.1

Overview

This is a disclosed quant-research workflow skill with local state and subagents, not hidden trading, credential theft, or destructive behavior.

Install only if you are comfortable with a quant-finance skill that saves local research context and passes your inputs to subagents. Prefer explicit /quant-research-lab invocation to avoid accidental activation. Do not enter broker credentials, API keys, account numbers, or confidential trading plans unless you accept that they may be stored in the project state file. Treat generated strategies and trading-system code as research drafts requiring independent testing, compliance review, and paper trading before any real use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (26)

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The PIT example claims to prevent look-ahead bias, but the implementation reads the latest version at or before the query time and then filters rows by an in-row as_of_date field. If a snapshot written before the query time already contains restated or future-known historical values, the query can surface data that was not actually knowable at the decision timestamp, corrupting backtests and research conclusions.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The timestamp anomaly detector hardcodes a reference time around 2024-01-01 instead of using the actual current time or pipeline processing time. This breaks future-timestamp detection, causing legitimate current data to be mislabeled or letting truly bad timestamps evade detection depending on when the code is run, which undermines data quality controls feeding trading systems.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs that circuit breakers should default to OPEN as a fail-safe control, but the provided implementation defaults them to CLOSED. In a trading-system context, this mismatch weakens the documented safety posture and could allow order flow to proceed before manual enablement or validation, especially if downstream users trust the sample code as production-ready.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The fencing implementation uses a >= comparison during write validation, but the token class only defines __gt__, making the sample code incomplete and likely to fail at runtime or behave unexpectedly. In a split-brain protection path, broken comparison logic can undermine leader validation and create ambiguity around whether stale writers are rejected.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger examples are broad enough that ordinary user requests such as 'do a backtest' or 'run risk analysis' could activate the skill unexpectedly. In an agent environment, unintended activation can cause the system to load prompts, spawn subagents, and persist state without the user clearly intending to invoke this skill, increasing the attack surface and creating opportunities for prompt/context hijacking by overlap with unrelated tasks.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README states that the skill activates automatically for broadly described 'quantitative research needs' without defining strict boundaries. That ambiguity makes accidental or adversarial activation more likely, especially in mixed workflows where users discuss finance, statistics, or research in general, and can route sensitive context into this skill's multi-agent pipeline unexpectedly.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger phrases include very broad expressions such as generic requests for backtesting or using a named role, which can cause the skill to activate in contexts where the user did not explicitly intend to run this skill. In an agent environment, unintended activation can inject hidden role prompts and alter behavior, creating prompt-routing and task-confusion risk even without overtly malicious content.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The automatic activation description is underspecified and does not clearly define when the skill should abstain, making over-triggering likely. Because this skill orchestrates multiple specialized subagents and persists state, accidental activation has more consequence than a simple informational skill: it can redirect the agent's workflow and write research context artifacts.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The natural-language examples use ambiguous phrases and omit counterexamples, which encourages matching on short common expressions like '做回测' or '风控分析'. This increases the chance of accidental prompt takeover in mixed conversations, where the agent may switch into the skill's specialized workflow without informed user consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The installation instructions direct the agent to create directories and run git clone into the local workspace, but they do not prominently warn that these actions modify the filesystem. In an agent setting, instructions framed as text to paste to another agent can lead to non-transparent workspace changes and supply-chain exposure from fetching remote content.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The natural-language triggers are broad enough that ordinary user requests about backtesting, risk, or trading could unintentionally activate the skill or the wrong role. In a multi-agent orchestration context, this can cause unintended prompt injection of the skill’s institutional role prompts, unexpected state changes, and execution of downstream workflow steps without clear user intent.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The usage section includes very short generic phrases like requests for backtesting or risk analysis that are common in normal conversations and may collide with unrelated contexts. Because the skill can dispatch sub-agents, persist state, and suggest downstream actions, accidental activation increases the risk of unintended agent behavior, context contamination, and user confusion about what system is acting.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README states that the skill auto-activates whenever users describe general quantitative research needs, which is an overly broad trigger surface for a high-impact orchestration skill. That can cause unintended invocation, context capture, and downstream file writes or sub-agent dispatch when the user did not explicitly request this skill, especially in mixed conversations about trading, research, or code.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Several listed trigger phrases are generic enough to appear in ordinary discussion, making accidental skill activation plausible. In this skill, accidental activation is more dangerous because invocation may launch multi-role workflows, persist research context, and influence later steps in a trading-related pipeline.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document says results are automatically saved to 'state/research-context.md' but does not prominently warn about persistence scope, sensitivity, retention, or overwrite behavior. For a quant research skill, this may store strategy details, market hypotheses, user inputs, and intermediate outputs on disk without clear user awareness, creating privacy and operational leakage risks.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README states the skill auto-activates when a user merely describes 'quantitative research needs', which is an overly broad activation condition. In an agent environment, this can cause unintended invocation on ordinary financial discussion, expanding the skill's authority and increasing the chance that role prompts, pipeline state handling, or downstream actions are triggered without explicit user intent.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The natural-language trigger section includes very short generic phrases like requests for backtests, risk analysis, status, or reset, which can easily occur in normal conversation. Such broad matching can lead to accidental activation, unintended state changes, or execution of skill-specific orchestration behaviors when the user did not actually mean to invoke this skill.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill uses very broad natural-language triggers such as generic requests for backtesting, factor work, optimization, or 'start pipeline', which can overlap with ordinary user conversation and unintentionally activate a complex orchestration flow. In this skill, accidental activation is more dangerous because activation leads to multi-step stateful behavior, role dispatch, and subagent prompting, increasing the chance of unintended tool use or propagation of sensitive context.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The operation commands include short, highly generic phrases like 'pipeline', 'status', 'reset', '继续流水线', and '做回测', without clear scoping to this specific skill. These can collide with normal user instructions or other skills, causing unauthorized state changes, resets, resumptions, or execution of role pipelines when the user did not intend to operate this skill.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly requires English as the primary output language rather than following the user's language preference. This is a policy and UX safety issue because it can override user intent, reduce comprehension for non-English users, and make important caveats or risk disclosures less accessible in a high-stakes finance context.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill content is entirely written to operate in Chinese and repeatedly constrains the output format and behavior without providing any user language choice or fallback. This can cause user-intent mismatch, reduce transparency, and make safety or compliance guidance inaccessible to users who do not read Chinese, which is a real policy/quality vulnerability for a broadly triggered agent skill.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill strongly prescribes Chinese as the default output language without any explicit user opt-in, which can override or conflict with a user's language preference and reduce transparency. In an agent setting, forced language can impair user comprehension, hinder review of financial or security-sensitive content, and create opportunities for prompt-level control that the user did not request.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly requires English as the primary output language, which can override or suppress the user's preferred language. This is a real policy and safety concern because it reduces user control, can impair comprehension for non-English users, and may cause the agent to ignore locale-sensitive instructions in downstream financial or risk content.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill hard-codes English as the primary output language, which can override or conflict with the user's language preference and reduce user control over outputs. While this is not a code-execution or data-exfiltration issue, it is a policy/compliance vulnerability because it can cause the agent to disregard explicit user intent and produce inaccessible or misleading results in multilingual contexts.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The skill appears to mandate Chinese output regardless of the user's preferences or explicit opt-in. This can override user intent, reduce usability, and create a prompt-level policy conflict where the model follows author-imposed locale constraints instead of the active user context.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.