Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward exchange-rate lookup tool that makes disclosed public market-data requests and does not show hidden persistence, credential use, or destructive behavior.
Install this if you are comfortable with a Chinese-language FX tool making live requests to Yahoo Finance and Frankfurter.app. Review the broad trigger terms if you want tighter activation, and do not treat the printed threshold commentary as financial advice.
The skill performs outbound network access to Yahoo Finance but does not declare any tool scope or allowed-tools restriction. This weakens least-privilege controls and makes the skill's external data access implicit rather than auditable, which can enable unexpected network use if the skill is modified or invoked in broader contexts.
The trigger list contains broad generic terms such as '汇率', '外汇', and '换汇', which can cause the skill to activate for ambiguous everyday finance conversations rather than clear user intent. Overbroad invocation increases the chance of unintended external requests and misleading context injection, especially because the skill fetches live network data and provides market interpretation.
The file’s title, comments, docstrings, console output, and interpretive messages are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale handling. Under the policy, a skill should not force a language or locale unless it explicitly offers choice or clearly documents a justified regional constraint.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"""欧洲央行汇率（备用数据源，不需要 key）"""
results = {}
try:
url = f"https://api.frankfurter.app/latest?base=USD&symbols={','.join(ECB_PAIRS)}"
r = requests.get(url, headers={"User-Agent": "Mozilla/5.0"}, timeout=15)
r.raise_for_status()
data = r.json().get("rates", {})
No suspicious patterns detected.