tqsdk
Pass
Audited by Gen Agent Trust Hub on Mar 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The documentation provides standard installation instructions using
pipto install thetqsdklibrary and its related management tools (tqsdk-zq). This is standard procedure for setting up a Python development environment. - [EXTERNAL_DOWNLOADS]: The skill correctly identifies that the framework must connect to ShinnyTech's official market data gateways (
openmd.shinnytech.com) and trading relays to function. These are legitimate and necessary connections for financial data retrieval. - [DATA_EXFILTRATION]: Contains a boilerplate example for a DingTalk message pusher (
send_msg). This uses standardrequests.postto a user-provided webhook for monitoring trading status, which is an expected feature for unattended trading strategies and does not constitute unauthorized exfiltration. - [CREDENTIALS_UNSAFE]: While the API requires authentication, all provided code examples use descriptive placeholders like "快期账户" (Fast-term account) or "账户密码" (Account password), ensuring no actual secrets are leaked in the instruction set.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external market data (quotes and K-lines). While this is an ingestion surface, it is the primary purpose of the tool and is handled through structured API calls rather than direct prompt interpolation, presenting a negligible risk profile.
Audit Metadata