Fund Weekly Report

基金周报生成。根据Excel数据自动生成基金周报Word文档。支持主动权益、固定收益、指数基金、FOF、QDII、REITs等各类基金的周度表现分析。

Security Scan

The skill appears consistent with its stated purpose (generate Word weekly fund reports from user-provided Excel files); its requirements and instructions are proportionate, but you should review and run it in a sandbox because it executes local Python code and installs PyPI packages.

Purpose & Capability

Name/description match the artifacts: scripts and references focus on extracting Excel sheets and producing Word reports. Declared deps (pandas, python-docx, openpyxl) and template usage match the stated functionality. No unrelated credentials, binaries, or config paths are requested.

Instruction Scope

SKILL.md instructs the agent to read user-provided Excel files (chat upload or local path) and write a Word file in the user's working directory, and it explicitly claims no network requests and no access to sensitive system dirs. That scope is coherent for the task, but because the package includes executable Python scripts, the actual behavior depends on those scripts — e.g., reading arbitrary local file paths or failing to enforce the stated directory restrictions would be a risk. The instructions rely on the user to supply only .xls/.xlsx inputs, which is reasonable but requires trust that the code enforces extension/validation checks.

Install Mechanism

There is no install spec in the registry, but SKILL.md tells users to pip install pandas, python-docx, openpyxl. Using PyPI packages is standard for this task; it does mean installing third‑party packages (supply‑chain risk). No unusual download URLs or archive extraction steps are present in the metadata.

Credentials

The skill does not request environment variables, credentials, or config paths. That is proportionate given the described functionality (local Excel->Word processing).

Persistence & Privilege

The skill is not always-enabled and does not request elevated platform privileges. It is user-invocable and allows autonomous invocation (platform default), which is normal for skills of this type.

Assessment

This skill is coherent with its purpose, but it includes executable Python scripts and asks you to pip-install packages. Before using it: (1) inspect the actual scripts (read_excel.py and the generate_*.py files) to confirm there are no network calls, subprocess executions, or code paths that read arbitrary filesystem locations beyond the uploaded Excel files; (2) only provide the required .xls/.xlsx files and a trusted .docx template; (3) run the skill in an isolated environment (container or VM) the first time; (4) install dependencies in a virtualenv so packages don't affect your system Python; (5) if you need stronger assurance, run static analysis (search for requests, urllib, socket, subprocess, os.system, open with absolute paths) or ask the author for a provenance / source repository and changelog. If you find the scripts making unexpected network calls or reading system files, do not run them with sensitive data or system-wide privileges.

基金周报生成

根据Excel数据自动生成基金周报Word文档。

安装

pip install pandas python-docx openpyxl

使用方式

发送基金周度收益Excel文件（必需），可选发送ETF资金流动Excel文件，AI会自动生成周报。

输入：

• 基金细分类型周度收益Excel（24个Sheet） - 必需
• ETF资金流动Excel - 可选

输出：

• 基金周报Word文档（楷体格式）

周报内容

1. 主要市场指数周度表现回顾
2. 主动权益基金周度表现复盘
3. 固定收益基金周度表现复盘
4. 指数型基金周度表现复盘
5. FOF基金周度表现复盘
6. 其他类型基金周度表现复盘
7. 基金成立与发行回顾
8. 附注及风险提示

安全声明

权限范围

权限	说明
读取Excel文件	读取用户明确提供的Excel文件（聊天上传或本地路径）
写入Word文档	将生成的周报写入用户工作目录

文件路径约束

• 只接受 .xlsx 或 .xls 扩展名的文件
• 禁止访问系统敏感目录（/etc/, /root/, .ssh 等）

不做的事情

• ❌ 不读取非Excel文件
• ❌ 不访问系统敏感目录
• ❌ 不发起网络请求
• ❌ 不存储凭据或密码

---

详见 references/ 目录了解更多技术细节。