HK IPO Decision Engine

Score Hong Kong IPOs, build decision cards, and batch-evaluate symbols or watchlists with explainable factors and execution guidance. Use when the user wants...

Security Scan

The skill bundles a local CLI for Hong Kong IPO scoring that matches its description: it runs a packaged runtime (uv + hkipo-next), reads/writes its own config/db files under ~/.hkipo-next, and calls public data sources to assemble scores and decision cards.

Purpose & Capability

Name/description align with the actual contents: the bundle includes scoring_service, decision_service, renderers, and many adapters (aipo, aastocks, hkex, jisilu, futu, tradesmart, etc.). Requiring the 'uv' runtime and local config/db files (~/.hkipo-next/...) is coherent with a packaged CLI that persists review records.

Instruction Scope

SKILL.md instructs the agent to run the included CLI via 'uv run --directory runtime/hkipo-next hkipo-next ...'. The runtime will access network data from multiple public endpoints (e.g., aipo.myiqdii.com, aastocks.com, hkex, suggest3.sinajs.cn, qt.gtimg.cn) and persists data in ~/.hkipo-next/data/hkipo.db and reads ~/.hkipo-next/config/*.json. This behavior is expected for the skill but means the agent will perform broad network scraping and local file reads/writes specific to this tool.

Install Mechanism

Install spec is a Homebrew formula for 'uv' (the CLI runner referenced throughout SKILL.md). Homebrew is a standard distribution mechanism; no arbitrary URLs or archive extraction are used. Installing 'uv' via brew is proportionate to the stated runtime requirement.

Credentials

The skill does not request environment variables or external credentials, which is consistent. It does require/configure local config and a sqlite DB under ~/.hkipo-next — these files will be created/used by the CLI and may contain user preferences, watchlists, and review history. The skill will therefore read/write user home files but does not request unrelated credentials.

Persistence & Privilege

always:false and no elevated privileges are requested. The skill installs a runtime binary (uv) and runs a local CLI, and it persists data under its own ~/.hkipo-next directory; it does not declare modifications to other skills or system-wide configurations.

Assessment

This package appears internally consistent with its stated purpose, but review these points before installing: - The skill runs a bundled CLI (hkipo-next) via the 'uv' runner and will perform network calls to many public data sources (e.g., aipo.myiqdii.com, aastocks.com, hkex, sinajs/qt.gtimg endpoints). Expect outbound HTTP(s) traffic when using it. - It reads and writes files under your home directory (~/.hkipo-next/config/*.json and ~/.hkipo-next/data/hkipo.db). Those files will contain watchlists, profiles, and persisted review history — inspect their contents if you care about local privacy. - The installer uses Homebrew to install 'uv'. If you have concerns, verify what the 'uv' formula points to in your Homebrew tap (source/repository) before installing. - If you need stronger isolation, run the skill inside a constrained environment (container or VM) or inspect the included source code (present in runtime/hkipo-next) — the bundle is large but human-readable and uses standard libraries (httpx, BeautifulSoup) not obfuscated loaders. - If anything would change this assessment: evidence that the 'uv' formula downloads arbitrary/external code during install, or that the runtime contains hidden endpoints / credential exfiltration logic. If you want, I can list the network endpoints called by the code and the paths that will be created/read under ~/.hkipo-next.

Use this skill for action-oriented decisions.

Runtime

This publish bundle includes the required CLI runtime under runtime/hkipo-next.

From the skill folder:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next ...

By default these commands persist review records in ~/.hkipo-next/data/hkipo.db.

Preconditions

• Prefer to have an active parameter version.
• Prefer to have a usable profile or explicit CLI overrides for risk, budget, and financing preference.
• If the user only wants rough market discovery, do not jump straight to this skill.

Choose the Right Command

• Use score for factor-level explanation.
• Use decision-card for a concise execution plan.
• Use batch for multiple symbols or the saved watchlist.

Commands

Score one symbol:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next score 2476 --format json

Score with explicit scenario overrides:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next score 2476 \
  --parameter-version v0003 \
  --risk-profile aggressive \
  --max-budget-hkd 120000 \
  --financing-preference margin \
  --format json

Generate one decision card:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next decision-card 2476 --format markdown

Batch explicit symbols:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next batch 2476 2613 2590 --format json

Batch the current watchlist:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next batch --watchlist --format json

Output Cues

• score returns factor contributions, cost breakdown, assumptions, and risk disclosure.
• decision-card adds a headline, position suggestion, and exit plan.
• partial outputs are often still usable; they usually mean source conflicts or incomplete upstream data, not total failure.

Companion Skills

• Use $hkipo-parameter-manager if there is no active parameter version or the user wants tuning.
• Use $hkipo-review-optimizer after outcomes are known and the user wants to refine the model.