Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent market-briefing workflow, but it can automatically send Feishu messages from broad topic triggers or scheduled runs, so it should be reviewed before installation.
Install only if you want an automated Chinese-language market briefing that performs live web searches and posts to Feishu. Configure the Feishu target carefully, prefer a private test DM first, and add a confirmation or draft-only step if broad topic mentions should not trigger outbound messages.
The topic trigger list is ambiguous and very broad, including terms like A股, 港股, 特朗普, 地缘政治, and 军事, which may appear in many unrelated conversations. In context, this is more dangerous because activation leads to network access, log reads/writes, and Feishu delivery, so a casual mention of these topics could trigger unintended tool use and outbound messaging.
The topic trigger list is ambiguous and very broad, including terms like A股, 港股, 特朗普, 地缘政治, and 军事, which may appear in many unrelated conversations. In context, this is more dangerous because activation leads to network access, log reads/writes, and Feishu delivery, so a casual mention of these topics could trigger unintended tool use and outbound messaging.
The skill sends content to an external Feishu target but does not present a clear user-facing warning in the skill description that activation may cause outbound communication. This is risky because users may believe they are requesting local summarization while the skill can transmit generated content to a chat or DM, potentially exposing sensitive prompts, context, or derived information.
The briefing templates are written to produce output in Chinese, including fixed Chinese headings and stock commentary text, with no indication that users can choose another language or that the skill is restricted to a Chinese-language audience. This is a natural-language locale policy concern because it imposes a specific language by default.
The skill is written to operate in Chinese, with Chinese trigger terms, Chinese search queries, and Chinese response text, but it does not state that language choice is optional or configurable by the user. This can violate language/locale policy when a skill implicitly forces a specific language without opt-in.
No suspicious patterns detected.
