スキル quantall-mcp

📦

quantall-mcp

Name: quantall-mcp
Author: mifochen

コンテンツリビジョン r1 高リスク ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス

Analyze A-Share Strategies with QuantAll

Large A-share datasets make factor testing and strategy validation slow and inconsistent. QuantAll runs vectorized local analysis and returns measurable backtest, IC, screening, and visualization results.

対応: Claude Codex Code(CC)

⚠️ 38 不十分

インストール前に停止して確認を求めてください。

計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "quantall-mcp" from https://skillstore.io/skills/mifochen-quantall-mcp.md and its manifest at https://skillstore.io/api/skills/mifochen-quantall-mcp/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/mifochen-quantall-mcp.md 署名済み manifest GET /api/skills/mifochen-quantall-mcp/manifest 署名済み lockfile GET /api/skills/mifochen-quantall-mcp/lockfile

テストする

「quantall-mcp」を使用しています。 Test whether smaller market capitalization predicts stronger next-month returns.

期待される結果:

Coverage summary with the tested universe, dates, and missing-data exclusions.
Factor report with IC direction, stability, quantile spread, and benchmark comparison.
Conclusion that separates measured evidence from interpretation and limitations.

「quantall-mcp」を使用しています。 Backtest a moving-average crossover and compare close execution with next-open execution.

期待される結果:

Side-by-side performance summary for both execution assumptions.
Return, drawdown, Sharpe ratio, win rate, turnover, and holding-period comparison.
Warnings about lookahead bias, data gaps, and sensitivity to parameters.

「quantall-mcp」を使用しています。 Find low-valuation stocks with improving profitability and inspect their industry distribution.

期待される結果:

Filtered stock set with each criterion stated clearly.
Industry distribution and concentration summary.
Data timestamp, field definitions, and excluded records.

セキュリティ監査

高リスク

v1 • 2026/7/24 バージョン別レポートを開く

All static pattern alerts are false positives caused by Markdown formatting, loopback addresses, scoped configuration writes, fixed subprocess arguments, or normal DuckDB access. Semantic review found high-risk sandbox-bypass guidance, unauditable Python execution, unverified remote installation, and SQL injection. Plaintext API token storage adds a medium-risk credential exposure.

スキャンされたファイル

3,745

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (5)

高

SKILL.md:73

Sandbox Bypass Guidance

SKILL.md recommends `dangerouslyDisableSandbox: true` when installation conflicts occur. This removes a security boundary instead of resolving the underlying file operation.

The bypass setting is stated directly as an installation workaround on line 73.

高

SKILL.md:21-27 SKILL.md:197-207

AI-Generated Python Execution Is Not Auditable

The core workflow executes AI-authored Python snippets through QuantAll. Only prompt-level restrictions are visible, while the external engine enforcing them is absent.

The documentation explicitly describes local Python execution and behavioral restrictions. The repository does not contain the QuantAll engine implementation needed to verify isolation.

高

SKILL.md:44-59 SKILL.md:133-151

Remote Package Installation Without Integrity Verification

Installation fetches quantall without a version or hash. Upgrade guidance requests the latest release from a remote mirror, allowing unreviewed code changes.

The documented pip commands omit both a version constraint and hashes, and the upgrade command explicitly selects newer remote content.

高

scripts/UpdateStock_skill.py:1422-1429 scripts/UpdateStock_skill.py:1480-1487

SQL Injection in Stock Query Tools

MCP parameters for symbols and dates are interpolated directly into DuckDB SQL. Crafted values can change query structure and access or modify local data.

Both MCP tools concatenate unsanitized string parameters into executable SQL before passing it to DuckDB.

中

scripts/UpdateStock_skill.py:1503-1541 scripts/UpdateStock_skill.py:1553-1588

Plaintext Tushare API Token Storage

Update tools direct users to store a Tushare API token in API_tushare.txt. The script reads the secret without access controls or protected storage.

The tool documentation and implementation explicitly create and read API_tushare.txt as the credential source.

リスク要因

⚙️ 外部コマンド (50)

scripts/UpdateStock_skill.py:1656 scripts/UpdateStock_skill.py:1665 scripts/UpdateStock_skill.py:1611 SKILL.md:27 SKILL.md:38 SKILL.md:45 SKILL.md:47 SKILL.md:50-69 SKILL.md:69-72 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:78-89 SKILL.md:89-95 SKILL.md:95-97 SKILL.md:97-103 SKILL.md:103 SKILL.md:105-109 SKILL.md:109 SKILL.md:111 SKILL.md:121-123 SKILL.md:123-127 SKILL.md:127-135 SKILL.md:135-137 SKILL.md:137-148 SKILL.md:148-150 SKILL.md:150 SKILL.md:151-152 SKILL.md:152 SKILL.md:162-164 SKILL.md:164-166 SKILL.md:166 SKILL.md:167 SKILL.md:175-179 SKILL.md:179-180 SKILL.md:180-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-184 SKILL.md:184-185 SKILL.md:185-186 SKILL.md:186-187 SKILL.md:187-188 SKILL.md:188-189 SKILL.md:189-190 SKILL.md:190-191 SKILL.md:191-192 SKILL.md:192-193 SKILL.md:193-194 SKILL.md:194-195

🌐 ネットワークアクセス (11)

scripts/UpdateStock_skill.py:1625 scripts/UpdateStock_skill.py:1635 scripts/UpdateStock_skill.py:1683 scripts/UpdateStock_skill.py:1624 scripts/UpdateStock_skill.py:1625 scripts/UpdateStock_skill.py:1680 scripts/UpdateStock_skill.py:1683 SKILL.md:56 SKILL.md:81 SKILL.md:139 SKILL.md:81

📁 ファイルシステムへのアクセス (24)

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/mifochen-quantall-mcp/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/mifochen-quantall-mcp/security.svg)](https://skillstore.io/skills/mifochen-quantall-mcp?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/mifochen-quantall-mcp?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/mifochen-quantall-mcp/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/mifochen-quantall-mcp.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

mifochen. (2026). quantall-mcp security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/mifochen-quantall-mcp/audits/1

BibTeX形式の引用

@techreport{mifochen-mifochen-quantall-mcp-2026,
  author = {mifochen},
  title = {quantall-mcp security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/mifochen-quantall-mcp/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "quantall-mcp security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "mifochen"
date-released: "2026-07-24"
url: "https://skillstore.io/skills/mifochen-quantall-mcp/audits/1"
identifiers:
  - type: other
    value: "skillstore:mifochen-quantall-mcp:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Validate a Trading Hypothesis

Backtest entry and exit rules across A-share history, then compare returns, drawdowns, and win rates.

Compare Candidate Factors

Measure IC, IR, and correlations for several factors before selecting complementary signals.

Maintain Local Market Data

Create or update a DuckDB dataset and configure the QuantAll engine to use it.

これらのプロンプトを試す

Inspect Available Data

Check the QuantAll service and list available fields. Summarize the date range, stock coverage, and missing data before analysis.

Backtest a Strategy

Backtest my stated entry and exit rules with close and next-open execution. Report returns, Sharpe ratio, drawdown, win rate, and assumptions.

Evaluate Multiple Factors

Compare these factors across the same period and universe: [factors]. Report IC, IR, stability, correlations, and redundant signals.

Run a Robust Research Workflow

Test [hypothesis] across [universe] and [period]. Check data availability, prevent lookahead bias, compare parameter ranges, and explain unstable results.

ベストプラクティス

Obtain explicit approval before installing packages, changing MCP configuration, starting services, or creating files.
Call available_data before analysis and use only documented vectorized operations.
State the universe, dates, execution assumptions, data gaps, and lookahead controls in every result.

回避

Do not disable the sandbox or weaken host protections to complete installation.
Do not install unspecified package versions or upgrade remote code without review.
Do not run parallel tools, assume field names, or expose oversized detail outputs directly.