The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The strategy templates for machine learning (found in ml_xgb/strategy.py and ml_logistic/strategy.py) utilize the pickle module to restore pre-trained models. This facilitates unsafe deserialization, which can be leveraged to execute arbitrary code if a malicious .pkl file is loaded into the strategy.
[COMMAND_EXECUTION]: The core/portfolio_runner.py utility employs subprocess.Popen to launch child processes for various trading strategies. Since the paths to these scripts are derived from a YAML configuration file, an attacker who can modify the configuration could achieve arbitrary command execution within the environment.

algo-expert