Security audit
Security checks for vulnerabilities and agentic risk
The financial-data queries fit the stated purpose, but the one-shot setup enables ongoing software and skill updates without explaining their scope.
Review background updating before setup. Prefer initialization with --no-auto-update unless you want continuing updates; if already initialized, inspect update status and use update disable to turn them off. Queries disclose their parameters to InvestToday, so avoid confidential research text. Verify quarterly versus TTM labels before relying on results. The external CLI implementation was not included in this review.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| `dmaDma` | DMA指标 | `3.75` |
| `dmaAma` | 平行线差指标 | `-0.015` |
| `mtmMtm` | MTM动量线 | `0` |
| `trixTrix` | 三重指数平滑平均线 | `0` |
| `trixTrma` | 三重指数平滑平均线的移动平均线 | `0.015` |
| `pageNum` | page number | `1` |
| `pageSize` | page size | `100` |
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| `dmaDma` | DMA指标 | `3.75` |
| `dmaAma` | 平行线差指标 | `-0.015` |
| `mtmMtm` | MTM动量线 | `0` |
| `trixTrix` | 三重指数平滑平均线 | `0` |
| `trixTrma` | 三重指数平滑平均线的移动平均线 | `0.015` |
| `pageNum` | page number | `1` |
| `pageSize` | page size | `100` |
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| `dmaDma` | DMA指标 | `3.75` |
| `dmaAma` | 平行线差指标 | `-0.015` |
| `mtmMtm` | MTM动量线 | `0` |
| `trixTrix` | 三重指数平滑平均线 | `0` |
| `trixTrma` | 三重指数平滑平均线的移动平均线 | `0.015` |
| `pageNum` | page number | `1` |
| `pageSize` | page size | `100` |
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
| `dmaDma` | DMA指标 | `3.75` |
| `dmaAma` | 平行线差指标 | `-0.015` |
| `mtmMtm` | MTM动量线 | `0` |
| `trixTrix` | 三重指数平滑平均线 | `0` |
| `trixTrma` | 三重指数平滑平均线的移动平均线 | `0.015` |
| `pageNum` | page number | `1` |
| `pageSize` | page size | `100` |
L115 instructs the agent to execute API requests once the endpoint and parameters are known. Although network access and financial-data retrieval are documented, the skill does not warn that user-derived search terms, security selections, and date ranges are transmitted to the external data provider and may reveal research interests.
L63 instructs the agent to call the API directly when the endpoint and parameters are clear. The description explains data retrieval but does not warn that user-derived query parameters are sent to an external provider, potentially disclosing security selections and research interests.
The profitability description explicitly promises single-quarter metrics, while the section heading, endpoint, and example identify TTM metrics. An agent relying on that description could retrieve trailing-twelve-month data and present it as single-quarter results, compromising financial-analysis integrity and potentially misleading comparisons; this is a documentation-driven integrity defect, not evidence of malicious execution.