Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it resolves mainland China security names by querying Eastmoney, with no hidden persistence or unrelated access found.
Install this if you are comfortable with security names or watchlist entries being sent to Eastmoney for lookup. For sensitive portfolios, use only the minimum names needed or review queries before running batch resolution.
The README explicitly states this is a Chinese securities code resolution skill for OpenClaw, and the rest of the document assumes Chinese-language inputs and China-market defaults. That creates a locale/language constraint without offering user choice or opt-in, which matches the policy-violation category for forced language or locale behavior.
The skill instructs the agent to run a bundled Python script that queries Eastmoney's public API, which is network-capable behavior, but the skill manifest declares no explicit tool scope or permissions. That mismatch weakens policy enforcement and user transparency: an agent may perform outbound requests without a clearly declared network allowance, making review, sandboxing, and least-privilege controls harder.
The script sends raw user-provided security queries to Eastmoney's external API without any disclosure, consent mechanism, or minimization. While the data sent is typically just instrument names, user queries can still contain sensitive portfolio interests, research intent, or proprietary watchlists, creating an avoidable privacy and data-leakage risk to a third party.
No suspicious patterns detected.
