Hk Ipo Research Assistant

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing dependencies may add third-party Python packages to the user's environment.

Why it was flagged

The skill asks the user to install Python dependencies before use. This is purpose-aligned for a Python CLI tool, but dependency installation can execute third-party package code and should be reviewed.

Skill content
pip install -r scripts/requirements.txt
Recommendation

Review scripts/requirements.txt before installing and use a virtual environment or other isolated Python environment.

What this means

IPO symbols or company names used in queries may be visible to the third-party data providers contacted by the tool.

Why it was flagged

The CLI fetches data from third-party financial websites. This is expected for real-time IPO research, but stock codes and query parameters are sent to external services.

Skill content
BASE_URL = "https://aipo.myiqdii.com" ... resp = client.get(f"{BASE_URL}{endpoint}", params=params, headers=self._get_headers())
Recommendation

Use it only for data you are comfortable querying through public financial-data sites, and verify important investment information from official sources.

What this means

Personal financial preferences may remain on disk and be reused in future IPO analysis.

Why it was flagged

The skill can persist a user's capital amount, risk preference, margin preference, and broker in a local profile file for later analysis.

Skill content
问用户:本金、风险偏好、是否用孖展、券商 ... 把答案写入 `scripts/config/user-profile.yaml`
Recommendation

Do not store secrets or account credentials in the profile file; review, edit, or delete scripts/config/user-profile.yaml when the stored profile is no longer needed.