Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Chinese-market sector screening helper that calls the disclosed iWencai API with a user-provided API key and does not show hidden persistence, local data harvesting, or destructive behavior.
Install only if you intend to use iWencai for China-market sector screening and are comfortable sending your sector-screening queries plus an iWencai API key to the documented iWencai API. Keep the API key scoped and private, avoid putting sensitive personal or account information in queries, and treat returned market data as informational rather than financial advice.
The skill explicitly requires access to an environment variable and makes outbound network requests, but it does not declare any tool scope or permission boundaries. This creates an authorization gap: a host agent may grant broader capabilities than intended, and users are not clearly informed that the skill needs secret access plus external transmission.
The manifest description states that when users ask about sector-screening questions, this skill must be used, and the entire skill guidance is written only in Chinese. That creates a language/locale constraint without user opt-in or a documented justification that the skill is intended only for Chinese-speaking or China-market contexts.
The skill instructs the agent to send user queries and an API bearer token to an external third-party endpoint. Even though external transmission is the intended function of the integration, it still creates privacy and secret-handling risk because sensitive prompts, financial interest data, and credentials are sent off-platform.
python3 scripts/cli.py --query "今日涨幅最大的板块有哪些？" --timeout 60
### curl 示例（脱敏）
```bash
curl -X POST "https://openapi.iwencai.com/v1/query2data" \
The manifest description forces a single language/locale for the skill's user-facing activation and purpose text. Under the policy, language-specific behavior should either offer user choice or clearly document that the skill is intentionally region-specific.