my_stock_report_skill

Before installing or enabling this skill, verify the following: 1) Confirm where run_cli.py and the Python virtual environment should live and that you trust the run_cli.py code — the skill will execute it and read files it produces (decision.txt, complete_report.md). 2) Ask the publisher or owner for explicit information about authentication: what supplies OPERATOR_ID and any DingTalk credentials? The SKILL.md calls https://api.dingtalk.com directly but lists no required env vars or tokens—do not assume credentials exist. 3) Validate the hard-coded Workspace ID and nodeId: ensure these are intended for your DingTalk workspace and not someone else’s. Hard-coded IDs can cause misdelivery of sensitive reports. 4) Confirm the presence and permission model of the referenced skills ('dingtalk-document' and 'my_stock_report_mgnt_skill'). Understand what credentials they need and who controls those credentials. 5) If you cannot confirm the above, treat the skill as potentially able to leak report contents to an external DingTalk workspace; either request a version that declares required credentials explicitly, or run the analysis and upload steps in an isolated environment under your control. 6) Note: no install-time downloads reduces supply-chain risk, but source is unknown and there is no homepage—exercise extra caution and prefer testing in a sandbox.