investment-advisor

This skill appears to implement the advertised analyses and calls public EastMoney APIs, but there are inconsistencies you should resolve before trusting it: 1) The runtime requires Node.js, yet the registry metadata lists no required binaries — ensure your environment runs the scripts in a sandbox and that you have a vetted node runtime. 2) Review Investment_API_Reference.md closely: it contains a GATEWAY_URL defaulting to https://internal-api.z.ai and a custom header (X-Z-AI-From). Confirm the shipped JS never uses that gateway in your deployed copy (search code for GATEWAY_URL or internal-api.z.ai). 3) Because the skill performs network fetches, run it in an environment where you can monitor outbound requests (or block network) to verify it only contacts expected EastMoney endpoints. 4) Note the package.json/registry version mismatch — ask the publisher for clarification or a reproducible build. 5) If you plan to let the agent call this autonomously, consider restricting network access or reviewing logs for unexpected endpoints first. If you are not comfortable with these discrepancies, test in an isolated sandbox or decline to install until the author clarifies the GATEWAY_URL snippet and updates metadata to declare 'node' as a required binary.