quant-all-mcp@1.0.4
VERIFIED· install onlyPublisher claims: "QuantAll（全A解析）MCP —— 股市全市场向量化计算引擎，为 AI 提供本地 Python 计算环境。 AI 编写向量化代码片段，数秒内完成 5000+ 股票的因子计算、策略回测、IC 分析和 GPU 可视化。 让 AI 从"信息查询者"升级为"数据计算者"——用代码算出客观结果，而非搬运网络观点。 触发：用户明确提到"回测""因子分析""IC分析""选股策略""QuantAll""全A解析"等量化关键词时。 不主动在普通股市聊天中触发，仅在用户有明确量化分析需求时使用。 能力声明：本技能需在用户电脑上创建 Python 虚拟环境（300MB+）、安装 quantall 库、 修改" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 91/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.