Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent public-data tracker for U.S. congressional stock trades and does not show hidden, destructive, persistent, or credential-seeking behavior.
Before installing, understand that the skill fetches public congressional trading data from the web and may save JSON or CSV files where requested. Treat its market analysis as research only, not investment advice, and choose output paths deliberately.
The skill invokes a networked data-fetching script and writes output files, but the manifest does not declare any tool scope or allowed-tools restrictions. This creates an over-permissioning/ambiguity risk: a host agent may allow broader filesystem or network access than intended, making misuse, SSRF-like fetch behavior, or unintended file writes harder to constrain and audit.
The manifest description and user-facing documentation are entirely in Chinese, and the skill presents its workflow and output requirements only in that language. There is no indication that language is user-selectable or that the Chinese-only constraint is required for a region-specific compliance purpose, which can violate language/locale policy expectations.
The document's title, instructions, templates, and required output language are all in Chinese, which effectively forces a specific language for use of the skill. Under the policy, language restrictions should either be optional for the user or clearly justified as a region- or locale-specific constraint.
该文件全文以中文呈现，未见任何说明允许其他语言、提供语言选项，或声明这是面向特定中文用户群的区域化资料。按规则，未经用户选择而固定单一语言可能构成语言/locale 政策问题。
The request headers force Accept-Language: en-US,en;q=0.5, which imposes a specific language/locale in network interactions. The file does not offer a user opt-in or configurable locale, and there is no documented region-specific reason for this restriction.
No suspicious patterns detected.
