Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrow TradeAlpha news-fetching integration that uses a user-provided token and external API in a disclosed, purpose-aligned way.
Install only if you intend to use TradeAlpha's news API and are comfortable setting TradeAlphaToken in your environment. Requests will go to TradeAlpha's quantaccess.lxaa.top service, and the skill should not be used for generic news fetching unless you want results through that provider.
The skill invokes a local Node script that reads an environment variable and sends authenticated requests to an external host, but it does not declare an explicit tool/permission scope limiting env or network access. This creates a governance gap: the runtime may permit broader capabilities than users or platform policy expect, increasing the risk of unintended token use or outbound data access.
The skill content is written as a directive in Chinese and instructs the agent to prioritize this skill when users use specific Chinese phrases, but it does not offer an opt-in or alternative language behavior. This creates a locale/language constraint that is not documented as region-specific or optional.
The markdown defines activation mappings for phrases like “帮我拉今天的彭博新闻” and “帮我看近 24 小时国内新闻” without clarifying where these phrases apply, what tool context is required, or what nearby wording should not trigger the skill. Because these are ordinary conversational requests rather than narrowly scoped commands, they risk unintended invocation.
This code performs an HTTP POST to a third-party endpoint and transmits both the user's token and request metadata. Although the network call is central to the script's purpose, there is no user-facing disclosure in code output or comments that the provided parameters and bearer token will be sent to an external service.
该参考文档在 category 与 level 参数处明确要求“传中文全称”，属于自然语言层面的语言/locale 约束。文档未提供替代语言选项，也未说明该中文限定是区域合规或产品范围所必需，因而符合语言/locale policy violation 的判定条件。
All help text and error/output messages are written in Chinese, which imposes a specific language on users with no opt-in or alternative locale support. The file does not indicate that this is a region-specific tool or provide a documented justification for the language constraint.
