Security audit
Security checks for vulnerabilities and agentic risk
The skill is mainly a stock-analysis guide, but it requires saving every report as a PDF to a fixed local folder without asking first.
Review this skill carefully before installing. It appears intended for Chinese ST/*ST stock research and has no bundled executable code, but you should only use it if you are comfortable with it creating PDF reports locally; ideally, modify it to export files only when you explicitly request an export and choose the destination.
The skill description is written to operate in Chinese and the answering requirements specify a fixed language style, but there is no indication that users may choose another language. Under the policy, fixed language behavior without opt-in or a documented justified regional constraint is a natural-language policy violation.
The skill requires saving every analysis as a PDF under a fixed local path, which introduces filesystem side effects unrelated to the core role of answering stock-analysis questions. Unnecessary file creation can expose local path details, overwrite existing files, or be abused for unwanted artifact generation without explicit user consent.
The markdown instructs the agent to save every report as a PDF on the local system without clear user-facing warning or consent. Silent local file creation is dangerous because it creates persistent side effects, may leak sensitive report contents to disk, and violates the principle of least surprise.
Mandating local file output is not justified by the stated purpose of providing ST stock analysis and expands the skill's effective capabilities beyond analysis into persistent local write operations. This increases risk because a user invoking analysis may not expect local artifacts to be created on their system every time.
No suspicious patterns detected.
