Security audit
Security checks for vulnerabilities and agentic risk
This skill provides structured public-fund performance attribution using disclosed finance data tools, with no hidden execution, persistence, or private-data handling found.
Before installing, understand that this skill may call the Investoday finance-data integration to look up public fund information based on a fund name or code. It should be used for analysis, not investment instructions, and users should verify any financial conclusions independently.
The skill advertises broad trigger phrases such as '业绩归因', '超额收益', and '主动管理能力' without defining clear activation boundaries, exclusions, or a disambiguation step. This can cause the skill to activate on general finance discussion and unnecessarily invoke downstream data-access skills, increasing the chance of unintended tool use and misrouting in sensitive financial contexts.
The trigger scenarios are written as open-ended natural-language examples and keywords, but they do not specify strong constraints on when the skill must not run. In an agentic environment, this ambiguity can lead to over-triggering on adjacent requests, causing unintended entity recognition and financial-data queries or bypassing more appropriate skills.
No suspicious patterns detected.
