Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed financial-data helper that fetches public stock quotes and formats built-in financial data, with no persistence, credential access, or destructive behavior found.
Install only if you are comfortable with stock symbols being queried against Sina Finance for live prices. Treat the bundled historical and estimate data as demonstration or reference data, not authoritative investment advice, and note that the interface is Chinese-language only.
The skill documents network access to Sina Finance APIs but does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: an agent may be allowed to make outbound requests without a clear least-privilege boundary, increasing the risk of unintended data exfiltration or misuse of network-capable tooling.
The natural-language description, headings, workflow, and cautions all require Chinese comprehension, effectively forcing a specific language for use of the skill. The policy requires either offering the user a language/locale choice or clearly documenting and justifying the locale constraint.
This code file contains user-facing natural-language text in the module docstring that is exclusively Chinese. Under the language/locale policy, forcing a specific language without offering a choice or documenting a justified locale constraint is a policy violation.
The argparse description and argument help strings are presented solely in Chinese, which forces a language choice on users of the script. The file does not offer localization, opt-in language selection, or a documented reason for restricting the interface to Chinese.
The skill sends user-requested stock symbols to a third-party API but does not warn the user that their inputs will be transmitted externally. Even if stock tickers are usually low sensitivity, this still weakens user consent and data-handling transparency, and in some contexts a queried symbol set could reveal research interests or trading intent.
The script prints warning and status messages in Chinese to stderr during normal execution. Because these are user-facing operational messages and no language choice or locale limitation is documented, they constitute a natural-language locale policy concern.
L298 的格式化输出会固定展示“分析师一致预期 (共{num_analysts}家)”，而数据集中不存在 num_analysts 字段，因此实际输出默认为 0 家。该文案给人的含义是代码掌握了分析师覆盖数量，但实际代码既未获取也未维护该信息，属于文案与实际行为不一致。
