Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent investment-research prompt stack, but users should understand that it can broadly steer the assistant and persist research workspace files.
Install this only in a workspace where you want an investment-research assistant to maintain local task state and archived research outputs. Review the system-prompt enablement carefully, because it is designed to make the assistant route market-related and some vague prompts into this harness automatically.
The trigger conditions include very common phrases such as greetings, help requests, and vague short inputs, forcing the menu to appear in situations that may be unrelated to this skill. Overly broad interception can hijack normal conversation flow, suppress user intent, and route users into unintended workflows that may later request installs or file modifications.
This rule explicitly instructs the model to trigger on semantic similarity rather than precise phrases, which materially broadens activation conditions. In an agent skill, that can cause unintended routing into research workflows, override normal conversational handling, and increase the chance of misfiring expensive or sensitive actions from ambiguous user input.
The installation instruction tells users they must copy the enable prompt into ~/.claude/系统提示词, using a Chinese-specific system prompt path and framing it as mandatory. Elsewhere the README presents the project as cross-platform and broadly applicable, but it does not offer an opt-in choice or explain that this locale-specific setup is only for Chinese-language environments.
The design philosophy section explicitly frames the project as a prompt stack rather than an agent and contrasts it with code-bearing runtime behavior. Elsewhere in the same file, the documented implementation includes executable setup and update scripts that perform environment detection, repository management, workspace creation, and installation actions, which goes materially beyond a 'pure markdown' description.
The table says the project is '纯 markdown' and therefore easy to audit, but later changelog and install sections document setup.sh, update.sh, bootstrap.sh, install scripts, and ClawHub-driven automation. That is an active contradiction in the documentation, not merely an omitted detail.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
### 路径 A · 最小安装（1 分钟）
把 `skills/sm-master/SKILL.md` 复制到任何 AI 工具的系统提示词里。1 个文件解决 80% 需求。
### 路径 B · 完整安装（5 分钟）
The install-time instruction to immediately display and begin from a broad menu creates a low-friction activation surface for the skill, even when a user may only be interacting generally with the assistant. In a prompt-stack environment, broad activation language can cause unintended routing into the skill and override the expected principle of only invoking specialized behavior on clear, scoped user intent.
The routing rule stating that any described task with no number should be auto-routed via autopilot is overly broad and ambiguous, allowing generic research or market-related prompts to trigger this skill without explicit user selection. This can lead to prompt hijacking of unrelated conversations, misapplication of the skill's internal instructions, and unexpected handling of user input in environments with multiple installed skills.
The file presents core operational instructions and the skill description in Chinese, indicating a fixed language/locale for the skill's behavior. There is no nearby indication that users may choose another language or that the Chinese-only constraint is required for a region-specific compliance purpose.
The title explicitly presents the acceptance checklist in Chinese ("输出验收清单"), and the entire document mandates a fixed Chinese-language output format for self-check sections. This is a natural-language locale policy issue because the skill content does not offer the user any language choice or explain why Chinese is required for all users.
Line L048 states that all query parameters must use Chinese natural language, which is a language-policy constraint expressed in natural language. The file does not offer the user a language choice or explain why Chinese is required for all contexts, so this is a locale-policy violation under the stated rule.
The checkpointing rules require writing task content and fetched research results to workspace files, but this persistence behavior is not clearly disclosed where the mechanism is introduced. Users may reasonably expect a research skill to operate ephemerally; undisclosed local persistence changes the privacy and data-retention model and can expose sensitive notes or market research to later sessions.
This section explicitly instructs the skill to persist completed sections, in-progress content, and fetched data into workspace checkpoint files. That expands the skill from transient research assistance into durable data storage without a clear upfront consent boundary, which can cause sensitive research content, prompts, or proprietary notes to be written to disk and later resumed unexpectedly.
These instructions direct the skill to read and modify tracking files, write final outputs, and delete checkpoint files as part of normal operation. Even if intended for workflow management, this broadens file-system side effects beyond the manifest's high-level research framing and creates risk of unintended file modification or deletion if the workflow is triggered in the wrong context.
Allowing resume on vague phrases like '接着上次的' overlaps with ordinary conversation and can trigger file reads and stateful continuation without the user intentionally invoking checkpoint recovery. In a skill that automatically loads task state and writes outputs, ambiguous activation increases the chance of unintended data access and side effects.
The entire skill guidance is written only in Chinese, including required and prohibited phrasing, with no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
The entire skill description and operational rules are written only in Chinese, including market labels, recognition rules, and user-facing guidance. This creates a language-policy concern because it implicitly constrains use to Chinese without any stated opt-in or alternative language handling.
The manifest describes the skill as an 'Open prompt stack for public-market research' with a 13-item menu ending at Autopilot and Master Mode. This file's actual menu adds three batch workflows and expands the menu to 16 items, changing the presented behavior and available operations users are told the skill supports.
The natural-language router maps broad keywords like '看看', '整理', '事件', or '模型' to specific skills without stronger scope checks. Ambiguous keyword routing can misclassify user intent and activate workflows that gather data, create persistent artifacts, or otherwise alter behavior beyond what the user expected.
The file instructs the agent to perform workspace initialization actions, including installation and file creation, that are broader than a simple menu/prompt-routing role. That expands the skill from passive UI behavior into state-changing local operations, increasing the risk that a user triggers filesystem or package-management actions without understanding the scope.
The document presents a package-install command as part of the flow without an explicit warning that it performs a system-changing action. Encouraging installation from within a prompt-routing/menu skill is risky because it normalizes command execution and may lead users to run package-management operations they did not intend to authorize.
The initialization flow directs collection of role, coverage scope, and tracked securities, then persists them into local workspace files. Even if intended for personalization, this is user profiling and durable storage of potentially sensitive professional/work-product data without a clear minimization policy, retention notice, or explicit consent around persistence.
The skill directs creation of multiple local files as part of initialization but does not warn the user that their filesystem will be modified. Silent or under-disclosed persistence is dangerous because users may reveal sensitive work information assuming it is ephemeral, while the agent stores it in durable files.
The title and throughout the document present the archive standard in Chinese and prescribe Chinese company names for directory naming, which can amount to a language/locale constraint. The file does not indicate that users may choose another language or locale, nor does it justify the restriction as region-specific.
These lines require the name field to use Chinese company names for A-share and Hong Kong stocks, while only U.S. stocks may use English names. That is a natural-language locale policy that is enforced by the skill documentation without any user choice or explicit regional justification.
No suspicious patterns detected.