Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed A-share stock analysis workflow, with no bundled executable code or hidden persistence found.
Before installing, understand that this skill is meant to run local Python scripts and fetch market/news data to produce investment-style reports. Only use it in a workspace where the referenced scripts are known and trusted, and treat the generated report as informational rather than financial advice.
The trigger is defined broadly enough that ordinary user requests for A-share stock analysis could invoke this skill automatically, even when the user did not explicitly request /halo. This increases the chance of unintended activation, surprising execution of local scripts, and unnecessary access to financial/news data sources in contexts where a simpler response would have sufficed.
The markdown trigger text says any request to analyze an A-share stock should activate the skill, which is an ambiguous auto-trigger condition. In practice, that can cause overbroad routing of normal conversation into a workflow that executes multiple Python scripts and fetches external data, creating avoidable security and safety exposure through unintended tool use.
