skills/algoderiv/agent-skills/tqsdk/Gen Agent Trust Hub

tqsdk

Pass

Audited by Gen Agent Trust Hub on Mar 6, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The documentation provides standard installation instructions using pip to install the tqsdk library and its related management tools (tqsdk-zq). This is standard procedure for setting up a Python development environment.
  • [EXTERNAL_DOWNLOADS]: The skill correctly identifies that the framework must connect to ShinnyTech's official market data gateways (openmd.shinnytech.com) and trading relays to function. These are legitimate and necessary connections for financial data retrieval.
  • [DATA_EXFILTRATION]: Contains a boilerplate example for a DingTalk message pusher (send_msg). This uses standard requests.post to a user-provided webhook for monitoring trading status, which is an expected feature for unattended trading strategies and does not constitute unauthorized exfiltration.
  • [CREDENTIALS_UNSAFE]: While the API requires authentication, all provided code examples use descriptive placeholders like "快期账户" (Fast-term account) or "账户密码" (Account password), ensuring no actual secrets are leaked in the instruction set.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external market data (quotes and K-lines). While this is an ingestion surface, it is the primary purpose of the tool and is handled through structured API calls rather than direct prompt interpolation, presenting a negligible risk profile.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 6, 2026, 06:24 PM