Security Considerations for AI-Berkshire: Protecting Financial Data and API Credentials

AI-Berkshire implements a defense-in-depth security model that protects API credentials through environment variables, prevents prompt injection via input sanitization, and isolates filesystem operations to the repository directory, though users must manually configure secrets and validate data licenses.

AI-Berkshire is an open-source research platform that combines financial data scraping, quantitative back-testing, and AI-driven report generation. Because it processes sensitive market data and interacts with external APIs like Xueqiu and Morningstar, understanding the security considerations for ai-berkshire is essential for safe deployment. The repository follows a minimalist security posture typical of research projects, emphasizing credential isolation, dependency pinning, and private vulnerability disclosure.

API Key and Credential Management

The repository does not ship with any hardcoded secrets. All API keys for financial data providers must be supplied at runtime via environment variables or a private .env file excluded by .gitignore.

In tools/xueqiu_scraper.py, the code retrieves the Xueqiu API key using os.getenv():

import os
from pathlib import Path

API_KEY = os.getenv("XUEQIU_API_KEY")
if not API_KEY:
    raise RuntimeError("XUEQIU_API_KEY not set – set it in a .env file or the environment")

This pattern ensures that sensitive credentials never appear in source control. The SECURITY.md file explicitly directs reporters to disclose vulnerabilities privately, preventing accidental exposure of security flaws in public issues.

Preventing Prompt Injection in AI Agents

The AI-driven agents defined in skills/*.md accept free-form user prompts, creating a potential prompt injection attack surface. Malicious prompts could attempt to extract internal logic, execute unintended commands, or bypass safety controls.

According to the source code, the repository addresses this by treating all user-generated text as data only—no shell execution is performed based on AI outputs. The CONTRIBUTING.md documentation warns contributors not to open public issues for prompt-injection bugs, instead directing them to the private disclosure process outlined in SECURITY.md.

Dependency Safety and Supply Chain Risks

Python scripts across the tools/ directory import third-party libraries including pandas, numpy, and requests. To mitigate supply chain risks, the repository pins dependency versions in requirements.txt where present.

For example, tools/morningstar_fair_value.py uses explicit dtype specifications when parsing CSV files:

import pandas as pd

def load_fair_value(csv_path: str) -> pd.DataFrame:
    # Enforce column types and disallow arbitrary parsing options

    dtype_map = {
        "ticker": str,
        "fair_value": float,
        "date": str,
    }
    return pd.read_csv(csv_path, dtype=dtype_map, parse_dates=["date"])

Explicit dtype mapping prevents maliciously crafted CSV rows from being interpreted as Python objects or code. Contributors should run pip list --outdated regularly and upgrade vulnerable packages to maintain security.

Data Privacy and Licensing Compliance

The platform ingests market data from public sources into data/*.json and data/*.csv files. While these datasets support quantitative analysis, redistribution of proprietary market data may violate terms of service.

The README.md emphasizes that the repository is intended for research only. All shipped data files are either publicly licensed or derived from open APIs, ensuring compliance with data provider agreements. Users must verify licensing terms before redistributing any downloaded financial datasets.

Filesystem Isolation and Safe Logging

Helper scripts like tools/log-command.sh write operational logs locally, requiring careful filesystem isolation to prevent unauthorized writes outside the repository.

The bash script confines output to the logs/ directory:

#!/usr/bin/env bash

# Log command output safely inside the repository

LOG_DIR="$(dirname "$0")/../logs"
mkdir -p "$LOG_DIR"
exec >>"$LOG_DIR/$(date +%Y%m%d_%H%M%S).log" 2>&1
"$@"

This pattern ensures that log files remain within the repository boundary and never write to absolute system paths. The .gitignore file prevents accidental commits of log files, keeping the repository clean and preventing potential information leakage.

Vulnerability Disclosure Process

AI-Berkshire maintains a structured security reporting workflow through SECURITY.md. The policy mandates private disclosure for all security vulnerabilities, requiring reporters to contact maintainers directly rather than opening public issues.

This approach prevents attackers from exploiting known vulnerabilities before patches are available. The CONTRIBUTING.md guidelines reinforce this by explicitly warning contributors not to file public bug reports for security-related issues, including prompt injection vulnerabilities in AI agents.

Summary

• Credential Isolation: API keys must be configured via environment variables or .env files, with no secrets hardcoded in the repository.
• Input Validation: CSV parsers in tools/morningstar_fair_value.py use explicit dtype specifications to prevent injection attacks.
• Private Disclosure: Security vulnerabilities must be reported privately through the process defined in SECURITY.md, not via public issues.
• Filesystem Confinement: Logging scripts restrict output to the logs/ folder, preventing writes to system directories.
• Dependency Management: Third-party libraries should be pinned and regularly updated to mitigate supply chain risks.

Frequently Asked Questions

How should I store API keys when using AI-Berkshire?

Store API keys in environment variables or a private .env file that is excluded by .gitignore. The repository follows the pattern shown in tools/xueqiu_scraper.py, which retrieves the XUEQIU_API_KEY environment variable and raises a runtime error if the credential is missing. Never commit API keys to source control.

What is the risk of prompt injection in AI-Berkshire?

The AI agents in skills/*.md process user-supplied prompts, creating a risk that maliciously crafted inputs could extract internal logic or manipulate outputs. The codebase mitigates this by treating all user-generated text as data only—no shell execution is performed based on AI outputs. Report suspected prompt injection vulnerabilities privately via SECURITY.md.

Does AI-Berkshire automatically update dependencies?

No, the repository does not automatically update dependencies. Users should manually review requirements.txt and run pip list --outdated to identify vulnerable packages. The Python tools use explicit dtype specifications when parsing data to minimize risks from malicious inputs, but keeping dependencies current is the user's responsibility.

Where should I report security vulnerabilities?

Report security vulnerabilities privately following the disclosure process in SECURITY.md. Do not open public GitHub issues for security bugs, as this could expose the vulnerability to attackers before a patch is available. The CONTRIBUTING.md guidelines explicitly prohibit public reporting of security-related issues.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}