Stock Analysis Skill

Things to check before installing or running this skill: - Metadata mismatch: the registry lists no required env vars, but the skill expects STOCK_LIST and optionally TAVILY_API_KEY, ALPHA_VANTAGE_API_KEY, and TUSHARE_TOKEN. Treat these env vars as needed and do not provide unrelated secrets. - Source trust: Homepage is missing and the owner ID is opaque. Prefer skills with a verifiable repository or maintainer before giving API keys. - Review SKILL.md raw text for hidden/control characters (the scanner flagged 'unicode-control-chars') and open the file in a hex-capable editor if concerned. - Limit credentials: create API keys with minimal privileges and quota-limited/free-tier keys where possible. Do not supply AWS/GCP/other cloud credentials — this skill does not require them. - Run in a sandbox: install and run in an isolated environment (container or VM) first to observe network calls and behavior. - Inspect network endpoints: the code will contact (at least) api.tavily.com (news), external data libraries (yfinance which pulls from Yahoo), AkShare/efinance/Tushare/Alpha Vantage. If you need to prevent exfiltration, block or monitor outbound traffic to unknown endpoints. - Note missing features: the README/SKILL.md mention multi-channel notifications and scheduled analysis, but those integrations are not present in the source; expect limited functionality unless you implement those parts. What would change this assessment: a public repository or homepage with commit history & maintainer identity (increases confidence), or corrected registry metadata listing required env vars would reduce the 'suspicious' tag. Conversely, discovery of telemetry/exfiltration code or hidden remote install steps would raise the severity.