Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward stock quote command that sends the requested stock symbol to Sina Finance and prints market data.
Before installing, be aware that stock symbols you query are sent to Sina Finance over HTTPS and the interface/output is primarily Chinese. The artifact does not show local data access, credential use, persistence, or destructive behavior.
The entire skill description is written in Chinese and presents the skill as a Chinese-language experience, with no indication that users may choose another language or locale. Under the policy scope for natural-language violations, this can be interpreted as a language constraint without explicit user opt-in.
The display name is provided only in Chinese ("股票查询"), which indicates a language-specific presentation in the manifest without any visible user opt-in or documented locale scope. For a general skill manifest, this can violate language/locale policy when no alternative language option or justification is present.
The file contains user-facing natural language in Chinese in its description and later emits Chinese-only error/output strings, which imposes a specific language/locale without any opt-in or alternative. This matches the language/locale policy concern for natural-language behavior.
The manifest uses only Chinese in the skill name and description, which can amount to a language/locale constraint without any opt-in or documentation that the skill is intended only for Chinese-speaking users or China-region usage. This matches the policy-violation category for language or locale constraints expressed in natural language.
No suspicious patterns detected.
