stock-market-hotspot-discovery
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code, required EM_API_KEY, and runtime instructions are coherent with its stated purpose of querying an East Money hotspot-discovery API; no unrelated credentials, odd network endpoints, or high-risk install steps were found.
This skill appears to do what it says: it calls an East Money hotspot-discovery API and returns Markdown. Before installing: (1) confirm you trust the East Money service and that the EM_API_KEY you provide is scoped/rotatable; (2) do not hard-code the key — use environment variables as instructed; (3) be aware the Python module will raise an exception on import if EM_API_KEY is missing (set the variable in the environment where the agent runs or the import will fail); (4) note the script will save Markdown files under a default miaoxiang/... directory (you may want to review or change output_dir when calling discover_hotspot); (5) run the script in an isolated environment or sandbox if you want to limit network exposure. If you want higher assurance, review the live API endpoint policy and confirm that the EM_API_KEY cannot be abused for broader access.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.