Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese A-share report generator, but it can run broad searches, save reports by default, and produce concrete trading instructions.
Review this carefully before installing. It is not malware, but it can generate specific trading plans and save files automatically; use it only when you intentionally want Chinese A-share research drafts, verify all market data independently, and avoid treating the output as personalized financial advice.
The description is written as generating A-share investment reports in Chinese and does not indicate that the user may choose another language or locale. This can violate language/locale policy when a skill implicitly mandates a specific language without user opt-in.
The trigger condition is so broad that merely mentioning a company name can activate the skill, increasing the chance of unintended invocation. In this skill, unintended activation can cascade into multiple web searches and file creation, causing surprising side effects and potentially generating misleading investment content without explicit user intent.
The skill instructs the agent to write files into the workspace by default without an explicit user-facing notice or confirmation. Because the skill also supports batch generation, an unintended trigger could create many files, clutter the workspace, overwrite expected outputs, or surprise the user with persistent side effects.
The entire template is written in Chinese and structurally requires the generated report content, headings, and labels to be produced in Chinese. There is no indication that the user can opt into another language or locale, which may violate language-choice policy for generally applicable skills.
The template provides concrete trading actions, position sizing, entry points, stop-losses, and price targets, which can lead the model to generate actionable financial advice without prominent in-flow risk warnings or user suitability checks. In the context of an investment-report skill, this is more dangerous because the content is explicitly framed for retail investment decisions and may be treated as authoritative despite the brief end-of-report disclaimer.
