Security audit
Security checks for vulnerabilities and agentic risk
This skill is a read-only A-share market research helper that fetches public index data and avoids trading, credentials, persistence, or hidden actions.
Install this only if you want a Chinese-language, China A-share market research workflow and are comfortable allowing it to make public market-data network requests through AKShare. Review any dependency you install separately, and do not treat the output as trading advice or authorization for account actions.
The skill instructs the agent to execute a local Python script via shell, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authority-boundary problem: a caller or platform may not have a machine-readable restriction on shell use, making unintended command execution easier if the skill is invoked in a broader context.
This markdown file contains user-facing natural language instructions exclusively in Chinese, which can constitute a language/locale policy violation when no opt-in or alternative language option is provided. The content does not state that the skill is region-specific or limited to Chinese-speaking users.
This code presents user-facing descriptions, errors, and rendered output entirely in Chinese, and it fixes the timezone to Asia/Shanghai. The file does not offer user opt-in for language/locale selection or explain that the skill is intentionally region-specific, which fits the language/locale policy violation category.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if args.date:
command += ["--date", args.date]
try:
child = subprocess.run(command, capture_output=True, text=True, timeout=args.timeout)
if child.returncode:
result = failure("采集进程失败；未生成行情结论")
else:
This code includes natural-language string expectations in a specific language ("新浪" and "东方财富"). Under the policy rule for language/locale constraints, hard-coding a specific language can be a violation when there is no indication of user choice or documented regional justification in the file.
Detected: suspicious.dynamic_code_execution