Security audit
Security checks for vulnerabilities and agentic risk
This skill clearly fetches China A-share daily stock data from Eastmoney and saves local JSON archives, with no hidden persistence or credential handling found.
Install only if you are comfortable with the skill making HTTP requests to Eastmoney and writing cached symbol lists plus raw market-data JSON files in the working repository. Review or constrain network access if your environment requires explicit destination allowlists.
The skill instructs the agent to perform network-backed data retrieval from Eastmoney APIs, but the manifest does not declare any tool scope such as permissions or allowed-tools. That creates an authorization and governance gap: an agent/runtime may execute network actions without an explicit policy boundary, making review, sandboxing, and least-privilege enforcement harder.
The short description is written in Chinese while the default prompt is written in English, and the file does not indicate that the user can choose a preferred language. This can create a language/locale policy issue because the skill presents a fixed language experience without documented opt-in or justification.
The thrown error message 无法识别股票代码或名称 is hard-coded in Chinese, creating a language/locale constraint for users who may not understand it. The file does not provide any opt-in, fallback, or documented justification for enforcing this language in user-facing output.
No suspicious patterns detected.
