Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent earnings-analysis skill that creates financial reports and notes, with no executable code or hidden unsafe behavior found.
Install this if you want Chinese-language earnings analysis reports and are comfortable with reports being saved in the workspace and key results being added to IMA notes. Use explicit stock symbols when possible to avoid accidental activation during casual earnings discussion.
The listed triggers include broad phrases like "看XX财报" and activation based on mentioning a stock code plus earnings-related terms, but they do not clearly define boundaries or exclusions. This can overlap with normal conversation about earnings or stocks and makes it unclear when the skill should activate versus when it should not.
The trigger conditions are broad enough to activate on ordinary financial discussion, including generic words like 'earnings', '季报', and '年报'. This can cause unintended invocation of the skill, leading to unrequested report generation, unnecessary external data access, and downstream file writes or note synchronization without clear user intent.
The skill explicitly writes reports to a working-directory path and syncs important results into IMA notes, but it does not disclose this persistence behavior to the user or require consent. Unannounced storage of user-request-derived content can create privacy, compliance, and data retention risks, especially if requests contain watchlists, portfolio interests, or sensitive research context.
The README is written entirely in Chinese and describes the skill output as a Chinese-language financial analysis workflow, while also including an English trigger phrase. There is no indication that users can choose output language or opt into Chinese-only behavior.
The README states that the skill saves reports to a dated path on disk, but it does not mention asking for user consent or clearly warning that a local file will be created. Silent file creation can surprise users, leave sensitive financial analysis artifacts behind, and create privacy or workspace-hygiene issues, especially in shared or synced environments.
The skill description, headings, workflow, and output template are all written to operate in Chinese, and there is no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
No suspicious patterns detected.
