Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent market-sentiment CSV analysis tool with disclosed local file input/output and no hidden network, persistence, or privilege behavior.
Installers should understand that this is a Chinese-first financial analysis helper. Use it only with CSV files you intend to analyze, choose any --output path deliberately, and treat its market scores and planner parameters as reference material rather than investment advice.
The skill description, examples, and operational guidance are written primarily in Chinese and present Chinese-language outputs as the default behavior, with no indication that users can select another language for normal operation. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill documentation shows command examples that read from and write through local files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may infer filesystem access is expected without any user-visible restriction, increasing the chance of unintended local file access in a larger toolchain.
Most of the skill’s operative description, feature names, model explanations, workflow text, and trigger phrases are presented only in Chinese, while English appears mainly in headings and disclaimers. This can functionally constrain usage to a specific language without an explicit opt-in or statement that other languages are supported.
The trigger list contains broad terms like 'sentiment', 'market context', and general market-state phrases that are likely to appear in ordinary financial discussion. Overbroad triggers can cause accidental invocation of this skill in contexts where the user did not request it, which may cascade into unnecessary file processing or downstream planner actions in the integrated workflow.
The description string is entirely in Chinese, and the topics also emphasize Chinese-language labels. Because this package metadata does not offer an alternate language or indicate that the skill is intentionally region-specific, it may violate language/locale policy by forcing a specific language without user opt-in.
The comment states the implementation is in Chinese ('纯 Python 标准库实现，无外部依赖'), which indicates a language-specific constraint in natural language. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint should be flagged.
This Python file contains natural-language instructions, disclaimers, and subsequent user-facing messages exclusively in Chinese, which effectively forces a specific language for operation and interpretation. The policy explicitly calls out language or locale constraints as violations unless the skill offers user choice or clearly justifies the restriction.
Command descriptions, reports, summaries, and error messages are emitted in Chinese only, so users cannot opt into another supported language. Because this is a general market-analysis tool rather than a clearly region-locked compliance utility, the fixed language behavior is a natural-language policy concern.
This markdown file mixes English headings with Chinese-only changelog content, which can impose a language choice on users without opt-in. The policy specifically allows locale constraints only when they are explicitly documented and justified, which is not present here.
The README's strong-market example maps a clearly overheated market state ('超买/overbought') to stock-planner: --market bear, which is contradictory to the surrounding semantics and likely to propagate incorrect downstream behavior when users integrate via the provided shell pipeline. Because the skill is explicitly designed to feed planner_param into another tool, this documentation error can cause systematically wrong trading configuration and unsafe decision automation.
No suspicious patterns detected.
