Security audit
Security checks for vulnerabilities and agentic risk
This credit-review skill is not malicious, but it should be reviewed because it handles sensitive banking data with third-party lookups and persistent local caches that are not tightly gated.
Install only in an environment where use of 财汇MCP, WebSearch, and the codebuddy.cn/Neodata endpoint is approved for banking review data. Treat customer audit reports, credit records, identifiers, and review notes as sensitive: redact before external calls, keep local SQLite/rule/case files access-controlled, and require human review before appending reusable rules or case history.
该代码与声明有一定关联，因为它服务于授信审查中的‘同行业基准对比’辅助环节，并生成企业 vs 行业基准的分析报告。但其实际范围明显更窄，主功能是本地 SQLite 基准库管理与分位数比较。声明中的核心能力——红线快筛、完整准入审查、四维风险分析、授信结论判定、补充尽调清单、规则库——在代码中都没有落地。尤其声明把‘连续三年亏损/资产负债率超85%/净资产为负’作为确定性判定红线，而代码仅支持一般性的指标对标，并未实现这些授信准入规则。资源使用上也存在差异：声明提到通过财汇MCP或公开来源拉取数据，而代码明确说明不能联网、不能直连MCP，只能 ingest 预先导出的 JSON。因此，这不是轻微实现细节差异，而是主要目的和能力范围均存在实质不一致。
声明描述的是较完整的授信准入审查/信用风险初审能力，核心卖点包括三条一票否决红线快筛和覆盖多维度的准入审查报告，并强调可连接外部权威数据源。代码却仅实现一个独立的财务测算工具，聚焦流贷需求上限和刚性负债偿债安全性，属于授信审查中的辅助子模块，而非声明中的整体准入审查专家能力。两者虽处于同一业务域，但主要目的和覆盖范围存在实质差异：声明的核心红线规则、四维审查、外部数据接入、补充尽调清单/规则库等均未在代码中出现。因此应判定为描述与实际行为不匹配。
Referenced artifact was not completely inspected
基准库文件：`data/industry_benchmark.db`（当前已覆盖房地产业 / 软件和信息技术服务业 / 批发业 2025 年报，共 120 家上市公司）。首次使用或扩充样本后，按"Agent 调 MCP 取数 → 保存原始 JSON → `ingest` 入库 → `compute` 重算"流程更新；`
Referenced artifact was not completely inspected
基准库文件：`data/industry_benchmark.db`（当前已覆盖房地产业 / 软件和信息技术服务业 / 批发业 2025 年报，共 120 家上市公司）。首次使用或扩充样本后，按"Agent 调 MCP 取数 → 保存原始 JSON → `ingest` 入库 → `compute` 重算"流程更新；`
Referenced artifact was not completely inspected
基准库文件：`data/industry_benchmark.db`（当前已覆盖房地产业 / 软件和信息技术服务业 / 批发业 2025 年报，共 120 家上市公司）。首次使用或扩充样本后，按"Agent 调 MCP 取数 → 保存原始 JSON → `ingest` 入库 → `compute` 重算"流程更新；`
The skill instructs the agent to read and update multiple local files, run local scripts, and maintain persistent rule/checklist artifacts, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an over-broad capability boundary: a host system may grant file read/write implicitly, and the skill can then modify local knowledge artifacts or reports without an auditable least-privilege declaration.
The trigger list contains many broad banking/risk phrases, making the skill likely to activate on generic finance-analysis requests beyond its narrowly intended underwriting-review use case. In a high-stakes banking context, accidental activation can cause the model to follow this skill's rigid workflow, read/write local artifacts, or produce quasi-authoritative risk outputs where the user did not intend a formal credit-admission process.
The document is written entirely in Chinese and frames the required report sections and writing guidance in Chinese as the mandated output format. There is no indication that users may choose another language or that the locale restriction is optional or justified as a region-specific requirement.
This markdown file presents all operational instructions and warnings only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not documented here.
Manifest 将该技能定位为银行授信准入初审专家，重点数据源是财汇MCP及必要时降级到公开来源，用于经营、财务、管理层与外部风险分析。这里的增强层明确加入实时行情、资金流向、机构一致预期、港美股等投资市场侧能力，属于比授信准入审查更宽的证券/市场数据分析扩展，和原始描述存在能力外延扩大。
The document instructs use of an additional external service at codebuddy.cn that is not clearly declared in the skill metadata/dependency description. In a banking risk-review context, this creates a real data-governance and exfiltration risk because sensitive customer identifiers, company names, financial context, or query parameters could be sent to an undeclared third party.
授信准入审查需要企业信用与经营风险分析，但本文件扩展到港美股证券接口、估值指标、北向资金、市场情绪和一致预期等投研风格能力。此类能力可作为辅助参考，但并非该技能声明目标下的直接且明显必需能力，因此构成与场景不完全相称的扩展。
The skill includes a concrete curl template for posting data to an external endpoint, which constitutes explicit external transmission behavior. In the context of bank credit review, operators may input sensitive enterprise/customer information; sending such data to a third-party service without strict controls can violate confidentiality, compliance, and vendor-risk requirements.
调用模板：
curl -s -X POST https://www.codebuddy.cn/v2/tool/financedata \
-H "Content-Type: application/json" \
-d '{"api_name":"daily_basic","params":{"ts_code":"000001.SZ","trade_date":"20260810"},"fields":""}'
The file explicitly instructs the agent to persist raw MCP JSON containing company financial and identifying data to local storage, but it does not define retention limits, minimization, access controls, encryption, or a user-visible notice. In a banking credit-review context, these records can contain sensitive corporate and possibly personal data, so indiscriminate raw-data storage increases the risk of unauthorized disclosure, over-retention, and secondary misuse.
The entire skill is written as mandatory Chinese-language methodology and report structure, with no indication that users may choose another language or locale. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
The title and instruction text require the methodology retrospective to be output in Chinese (e.g., '每次输出必附'), with no indication that users may choose another language. This creates a natural-language locale policy concern because the skill appears to mandate a specific language without opt-in or documented regional justification.
The document title and all operational guidance are written exclusively in Chinese, and the usage note instructs agents to read and apply this file as part of the workflow. There is no indication that language choice is optional or that the skill is explicitly limited to a Chinese-only or region-specific context, which creates a locale-policy concern.
The module docstring and all user-facing descriptions are written exclusively in Chinese, and throughout the script user-visible output is also hardcoded in Chinese. There is no indication that the skill is region-specific or that users can opt into this locale, which can violate language/locale policy for generally applicable skills.
The file explicitly requires that output language be Chinese, but it does not provide user opt-in or indicate that the skill is limited to a Chinese-language-only compliance context. This is a natural-language locale policy concern because it forces a language choice for all uses of the skill.
The entire checklist is written in Chinese and provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
This markdown file is entirely written in Chinese and begins with a Chinese-only title, with no indication that another language is available or that Chinese is a justified locale requirement. Under the policy rule for language/locale, a skill should not force a specific language unless it is explicitly optional or clearly documented as region-specific.
The entire skill file is written in Chinese and provides no indication that users may choose another language or locale. Under the policy rule for natural-language constraints, a fixed language without opt-in can be a locale-policy violation unless explicitly justified.
This markdown file is written entirely in Chinese and prescribes specific Chinese label formats such as 缺口 and Chinese citation templates as mandatory usage. Because the guidance does not indicate that Chinese is optional, user-selected, or justified as a region-specific constraint, it may violate a language/locale choice policy.
The entire skill file is written in Chinese and does not indicate that language selection is optional or limited to a China-specific deployment context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
The module docstring, CLI help text, runtime error messages, and generated report content are all written exclusively in Chinese, and the script provides no option to select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.