agent-stock

股市 AI 量化交易，用于获取股市实时数据、选股、交易决策、持仓分析、量化交易决策等。

Security Scan

The skill's content matches a stock-quant/trading assistant, but its runtime instructions ask the agent to install/run external packages (via pip) and reference user account information without declaring or justifying credential access—this mismatch and the implicit install step are concerning.

Purpose & Capability

Name/description (quantitative stock trading, screening, trade decisions) align with the instructions to call a 'stock' CLI and produce screening/trade reports. However, the docs reference using 'user account information' and performing trading actions while the skill declares no primary credential or required env vars; that omission is an inconsistency.

Instruction Scope

SKILL.md instructs the agent to run a local 'stock' CLI (stock index/quant/query/quote/detail/rank) and to save results to local files under dist/. It also tells the agent to install system components (Python/pip and then 'pip3 install agent-stock') if the CLI is missing. Asking the agent to install packages and manage the environment expands its runtime scope beyond pure analysis and could lead to executing arbitrary code. The doc also instructs to 'directly end' after saving (suppressing any additional output), which reduces transparency.

Install Mechanism

No formal install spec is declared in the registry, but the instructions explicitly direct installing an 'agent-stock' package via pip (and possibly installing Python). Having the agent perform a pip install of a package with the same name as the skill (without pinning a source or checksum) is a supply-chain risk: it may install arbitrary third‑party code from PyPI or elsewhere. This is a higher-risk install mechanism even though it is not part of the registry's install spec.

Credentials

The skill requests no environment variables or credentials in metadata, yet the workflow mentions using 'user account information' for decisions. If actual trading or account access is required, the skill should explicitly declare which credentials (broker API keys, exchange tokens) it needs. The absence of declared credentials but clear expectation of account-level data is a mismatch that could lead the agent to ask the user for sensitive secrets ad hoc.

Persistence & Privilege

always is false and the skill does not request persistent system-wide privileges. It writes output to local files (dist/...), which is consistent with its purpose. It does not claim to modify other skills or global agent settings.

What to consider before installing

This skill looks like a real stock/quant assistant, but be cautious: the instructions ask the agent to install a Python package named 'agent-stock' via pip and to install Python if missing—that could run arbitrary code from PyPI. Before installing or letting the agent run these commands, verify the provenance of that pip package (official project page, package owner, and checksum). Also, do not paste brokerage or trading API keys into chat; ask why and where credentials will be stored. Prefer skills that declare required credentials in metadata and provide a clear install source. If you intend to run this, run installation steps yourself in a controlled environment (isolated VM/container) and audit the pip package contents first.

帮助用户查询实时股市数据，分析数据，为用户提供交易决策。

Workflows

当用户有如下需求时，可以查看对应的文档，帮用户完成相关任务：

• 短线交易选股：参考文档 references/screen.md，为用户完成选股；
• 短线交易决策：参考文档 references/trade.md，为用户完成个股交易决策；
• 短线量化交易决策：参考文档 references/quant.md，为用户完成个股量化交易决策；
• 用户持仓分析：参考文档 references/holdings.md，为用户完成持仓分析；

Prerequisites

检查 stock 命令是否已安装：

stock -v

如果没有安装，需要先安装 stock 命令行工具：

uv:

uv tool install agent-stock

pip:

pip3 install agent-stock

如果用户没有 uv 或者 pip，需要先帮用户安装好 python 环境，然后使用 pip 安装 agent-stock 包。