📦

quantall-mcp

Name: quantall-mcp
Author: mifochen

Revisão do conteúdo r1 Risco alto ⚙️ Comandos externos🌐 Acesso à rede📁 Acesso ao sistema de arquivos

Analyze A-Share Strategies with QuantAll

Large A-share datasets make factor testing and strategy validation slow and inconsistent. QuantAll runs vectorized local analysis and returns measurable backtest, IC, screening, and visualization results.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Pare e solicite confirmação antes de instalar.

Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "quantall-mcp" from https://skillstore.io/skills/mifochen-quantall-mcp.md and its manifest at https://skillstore.io/api/skills/mifochen-quantall-mcp/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/mifochen-quantall-mcp.md manifest assinado GET /api/skills/mifochen-quantall-mcp/manifest lockfile assinado GET /api/skills/mifochen-quantall-mcp/lockfile

Testar

Usando "quantall-mcp". Test whether smaller market capitalization predicts stronger next-month returns.

Resultado esperado:

Coverage summary with the tested universe, dates, and missing-data exclusions.
Factor report with IC direction, stability, quantile spread, and benchmark comparison.
Conclusion that separates measured evidence from interpretation and limitations.

Usando "quantall-mcp". Backtest a moving-average crossover and compare close execution with next-open execution.

Resultado esperado:

Side-by-side performance summary for both execution assumptions.
Return, drawdown, Sharpe ratio, win rate, turnover, and holding-period comparison.
Warnings about lookahead bias, data gaps, and sensitivity to parameters.

Usando "quantall-mcp". Find low-valuation stocks with improving profitability and inspect their industry distribution.

Resultado esperado:

Filtered stock set with each criterion stated clearly.
Industry distribution and concentration summary.
Data timestamp, field definitions, and excluded records.

Auditoria de segurança

Risco alto

v1 • 24/07/2026 Abrir o relatório versionado

All static pattern alerts are false positives caused by Markdown formatting, loopback addresses, scoped configuration writes, fixed subprocess arguments, or normal DuckDB access. Semantic review found high-risk sandbox-bypass guidance, unauditable Python execution, unverified remote installation, and SQL injection. Plaintext API token storage adds a medium-risk credential exposure.

Arquivos analisados

3,745

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (5)

Alto

SKILL.md:73

Sandbox Bypass Guidance

SKILL.md recommends `dangerouslyDisableSandbox: true` when installation conflicts occur. This removes a security boundary instead of resolving the underlying file operation.

The bypass setting is stated directly as an installation workaround on line 73.

Alto

SKILL.md:21-27 SKILL.md:197-207

AI-Generated Python Execution Is Not Auditable

The core workflow executes AI-authored Python snippets through QuantAll. Only prompt-level restrictions are visible, while the external engine enforcing them is absent.

The documentation explicitly describes local Python execution and behavioral restrictions. The repository does not contain the QuantAll engine implementation needed to verify isolation.

Alto

SKILL.md:44-59 SKILL.md:133-151

Remote Package Installation Without Integrity Verification

Installation fetches quantall without a version or hash. Upgrade guidance requests the latest release from a remote mirror, allowing unreviewed code changes.

The documented pip commands omit both a version constraint and hashes, and the upgrade command explicitly selects newer remote content.

Alto

scripts/UpdateStock_skill.py:1422-1429 scripts/UpdateStock_skill.py:1480-1487

SQL Injection in Stock Query Tools

MCP parameters for symbols and dates are interpolated directly into DuckDB SQL. Crafted values can change query structure and access or modify local data.

Both MCP tools concatenate unsanitized string parameters into executable SQL before passing it to DuckDB.

Médio

scripts/UpdateStock_skill.py:1503-1541 scripts/UpdateStock_skill.py:1553-1588

Plaintext Tushare API Token Storage

Update tools direct users to store a Tushare API token in API_tushare.txt. The script reads the secret without access controls or protected storage.

The tool documentation and implementation explicitly create and read API_tushare.txt as the credential source.

Fatores de risco

⚙️ Comandos externos (50)

scripts/UpdateStock_skill.py:1656 scripts/UpdateStock_skill.py:1665 scripts/UpdateStock_skill.py:1611 SKILL.md:27 SKILL.md:38 SKILL.md:45 SKILL.md:47 SKILL.md:50-69 SKILL.md:69-72 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:78-89 SKILL.md:89-95 SKILL.md:95-97 SKILL.md:97-103 SKILL.md:103 SKILL.md:105-109 SKILL.md:109 SKILL.md:111 SKILL.md:121-123 SKILL.md:123-127 SKILL.md:127-135 SKILL.md:135-137 SKILL.md:137-148 SKILL.md:148-150 SKILL.md:150 SKILL.md:151-152 SKILL.md:152 SKILL.md:162-164 SKILL.md:164-166 SKILL.md:166 SKILL.md:167 SKILL.md:175-179 SKILL.md:179-180 SKILL.md:180-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-184 SKILL.md:184-185 SKILL.md:185-186 SKILL.md:186-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189-190 SKILL.md:190-191 SKILL.md:191-192 SKILL.md:192-193 SKILL.md:193-194 SKILL.md:194-195

🌐 Acesso à rede (11)

scripts/UpdateStock_skill.py:1625 scripts/UpdateStock_skill.py:1635 scripts/UpdateStock_skill.py:1683 scripts/UpdateStock_skill.py:1624 scripts/UpdateStock_skill.py:1625 scripts/UpdateStock_skill.py:1680 scripts/UpdateStock_skill.py:1683 SKILL.md:56 SKILL.md:81 SKILL.md:139 SKILL.md:81

📁 Acesso ao sistema de arquivos (24)

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/mifochen-quantall-mcp/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/mifochen-quantall-mcp/security.svg)](https://skillstore.io/skills/mifochen-quantall-mcp?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/mifochen-quantall-mcp?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mifochen-quantall-mcp/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/mifochen-quantall-mcp.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

mifochen. (2026). quantall-mcp security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mifochen-quantall-mcp/audits/1

Citação BibTeX

@techreport{mifochen-mifochen-quantall-mcp-2026,
  author = {mifochen},
  title = {quantall-mcp security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/mifochen-quantall-mcp/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "quantall-mcp security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "mifochen"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/mifochen-quantall-mcp/audits/1"
identifiers:
  - type: other
    value: "skillstore:mifochen-quantall-mcp:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Validate a Trading Hypothesis

Backtest entry and exit rules across A-share history, then compare returns, drawdowns, and win rates.

Compare Candidate Factors

Measure IC, IR, and correlations for several factors before selecting complementary signals.

Maintain Local Market Data

Create or update a DuckDB dataset and configure the QuantAll engine to use it.

Teste estes prompts

Inspect Available Data

Check the QuantAll service and list available fields. Summarize the date range, stock coverage, and missing data before analysis.

Backtest a Strategy

Backtest my stated entry and exit rules with close and next-open execution. Report returns, Sharpe ratio, drawdown, win rate, and assumptions.

Evaluate Multiple Factors

Compare these factors across the same period and universe: [factors]. Report IC, IR, stability, correlations, and redundant signals.

Run a Robust Research Workflow

Test [hypothesis] across [universe] and [period]. Check data availability, prevent lookahead bias, compare parameter ranges, and explain unstable results.

Boas práticas

Obtain explicit approval before installing packages, changing MCP configuration, starting services, or creating files.
Call available_data before analysis and use only documented vectorized operations.
State the universe, dates, execution assumptions, data gaps, and lookahead controls in every result.

Evitar

Do not disable the sandbox or weaken host protections to complete installation.
Do not install unspecified package versions or upgrade remote code without review.
Do not run parallel tools, assume field names, or expose oversized detail outputs directly.