Security audit
Security checks for vulnerabilities and agentic risk
This is a small local trading-signal helper that does not trade, access accounts, fetch remote code, or persist changes, though users should treat its financial signals cautiously.
Before installing, understand that this skill can output trading recommendations such as long, close, or short. Use it as informational signal logic unless you intentionally wire it into a trading bot, and add your own confirmation, position limits, stop-loss rules, and paper-trading validation before letting any automation act on its output.
The skill provides concrete automated trading actions, including '做多' and '平仓/做空', but does not warn users that these signals can directly affect real positions and cause financial loss. In the context of an agent skill that can be integrated with an existing trading bot, the lack of risk disclosure and operational safeguards makes unsafe or overconfident automated use more likely.
The manifest description specifies trigger phrases entirely in Chinese and presents the skill only in Chinese, which can constitute a language/locale restriction. There is no indication that users may invoke or use the skill in another language or that the locale limitation is intentional and documented.
The module docstring is written entirely in Chinese and frames the skill's purpose and behavior in that language, with no indication that other languages are supported or that the user can opt in to Chinese. The file also continues this language choice throughout user-facing strings, which can constitute a locale/language policy issue when no choice is provided.
No suspicious patterns detected.
