Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed options-hedging advisor with financial-decision risk, but the inspected artifact contains no hidden code, credential access, persistence, or trading authority.
Before installing, be aware that this skill can produce concrete options hedge ideas using live market data. Confirm the ticker, cost basis, and purpose before relying on results, check quote timestamps and data freshness, and do not treat the output as personalized financial advice or an instruction to trade.
The trigger phrases are broad enough to activate on ordinary investing conversation such as 'downside protection' or 'portfolio hedge', which can cause the skill to run without clear user intent. In this skill’s context, unintended invocation is more concerning because it fetches live options data and returns concrete ready-to-trade hedge recommendations that could influence financial decisions.
The skill advertises live option-chain resolution and ready-to-trade hedges but does not prominently warn users that outputs are based on live market data and may materially affect investment decisions. In a financial-advice-like context, lack of disclosure increases the risk that users over-trust the output, act on stale or misunderstood pricing, or mistake the skill for personalized advice.
The output section states the skill returns a scenario label and reason "(zh/en)," and the response schema hardcodes both Chinese and English fields. This can violate language/locale policy expectations if the skill imposes a language format without letting the user select their preferred locale.
