Security audit
Security checks for vulnerabilities and agentic risk
The skill’s stated purpose is coherent, but it executes an unbundled workspace Python script and can send reports by email, so users should review the local script and email configuration before use.
Install only if you trust the workspace’s stock-analysis/daily_review.py file. Before using --email, inspect the email_config.json recipient settings and use an SMTP app password or authorization code rather than an account password.
The skill name is presented in Chinese while the operational description is in English, but the manifest does not clarify intended user language, locale, or whether language selection is supported. This can indicate an implicit language constraint or inconsistent locale handling without explicit user opt-in.
The manifest explicitly advertises optional email sending, which implies outbound data transmission, but it provides no user-facing notice about what content may be sent, to whom, or under what trigger. In a reporting skill that may include market analysis or user-derived content, this creates a transparency and consent gap that could lead to unintended disclosure.
No suspicious patterns detected.
