Security audit
东方财富妙想skills套件/eastmoney MX skills suite
Security checks across malware telemetry and agentic risk
Overview
The skill mostly matches its finance purpose, but it can change account-linked watchlists or simulated trading state and has an under-disclosed API endpoint override that could affect where your API key is sent.
Use this only if you are comfortable providing an Eastmoney MX_APIKEY. Before using account-changing features, require the agent to ask for confirmation for every add/delete, buy/sell, or cancel action. Check that MX_API_URL is unset or points only to the official Eastmoney API, and treat the output folder as sensitive because it can contain raw financial and account-related data.
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.