Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only A-share financial report analysis skill with no evidence of hidden execution, persistence, credential access, or destructive behavior.
Install this for structured A-share financial-report analysis, and treat outputs as research support rather than investment advice. Specify a different market or output language when needed to avoid the skill's Chinese A-share defaults.
The file is named as an English README, but the only user invocation example is a Chinese phrase: "拆解德方纳米2025年年报". This natural-language guidance implies a required language/locale for interacting with the skill, without offering user opt-in or explaining that the skill is intentionally China-specific.
The skill description is entirely framed as an A-share financial report analysis system in Chinese, and the usage example and expected output imply operation in Chinese only. There is no indication that users may choose another language or locale, which can violate a language/locale policy when no opt-in is provided.
The manifest description includes many high-level trigger phrases such as '财报分析', '季报分析', and 'earnings report' that are common across unrelated workflows. Because manifests are often used for routing, embedding broad phrases here increases the chance of accidental invocation and prompt-scope capture beyond the intended A-share financial-report niche.
The trigger conditions are broad enough to activate on generic requests like '财报分析' or 'earnings report' without requiring a clear A-share scope, ticker, or reporting-period constraint. This can cause the skill to preempt more appropriate tools, leading to unintended data-source access, user-intent misrouting, and overly specialized output where the user asked for general financial analysis.
The template is entirely written in Chinese and targets A-share financial-report analysis, which strongly steers the agent toward Chinese-language output and China-specific locale assumptions without explicit user opt-in. This can cause user-experience and accessibility issues, and may lead the agent to ignore a user's preferred language or regional formatting, though it is not a direct security exploit.
The skill is written entirely in Chinese and defines output structures, labels, and examples only in Chinese, including user-facing report sections and disclaimers. There is no statement allowing the user to choose another language or confirming that Chinese is required due to a documented regional constraint.
No suspicious patterns detected.
