Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed, read-only market price lookup tool with ordinary network access and no evidence of hidden control, credential use, persistence, or destructive behavior.
Install only if you are comfortable with a skill that installs Python packages and contacts Sina Finance and AkShare-backed market data sources. Treat its investment advice as informational, and consider updating or reviewing pinned dependencies before use in a sensitive environment.
The skill documents outbound network access and executable commands, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch can cause the runtime or reviewer to underestimate the skill's capabilities, weakening least-privilege controls and making unexpected external requests easier to overlook.
The dependency is pinned to requests==2.32.3, which is flagged with known security advisories, including a .netrc credential leak issue when handling malicious URLs. In an agent skill that may fetch market data from external sources, using a vulnerable HTTP client increases the chance of credential exposure or unsafe file-handling paths if affected functionality is reached.
The manifest description and trigger examples are predominantly Chinese, and the skill presents Chinese output labels and guidance as the default interaction mode. Because there is no explicit opt-in or statement that users may choose their preferred language, this can be read as a language/locale default imposed by the skill.
This code makes outbound HTTP requests to Sina to retrieve quote data, but there is no user-facing notice beyond the module docstring that external network access will occur. For a code-file warning check, the operation lacks a confirmation prompt, logging/print disclosure, or comment/docstring near the network action explaining that requests are sent to third-party services.
No suspicious patterns detected.
