Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a legitimate market-data analysis skill, but its local temp/cache handling and broad execution surface need review before installation.
Install only if you are comfortable with a finance-analysis skill that calls multiple public market/news APIs and stores local caches. Avoid running it as a privileged account or on shared multi-user systems until the /tmp cache and batch-output handling are hardened. Treat its trading scores and signal labels as informational analysis, not investment recommendations.
scripts/lib/analysis/industry_classifier.py:10Predictable Shared Cache File Permits Local Data Poisoning and Symlink-Based File Overwrite
scripts/batch_fetch.sh:7Predictable Batch Directory Enables Local Symlink-Based Output Overwrite
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
Claiming sophisticated real-time, multi-market, multi-factor analytics while only computing simple daily percent change via yfinance is a severe capability mismatch. This can materially mislead users into relying on outputs for trading or automation decisions and obscures the true set of external dependencies.
The manifest exposes a tool entrypoint that can invoke code and the surrounding analysis indicates capabilities for environment access, file I/O, and network use, yet the skill declares no explicit permission or allowed-tools scope. In an agent setting, missing scope boundaries increases the chance the skill is invoked with broader privileges than users expect, especially for a market-data skill that does not obviously need unrestricted local file writes.
An overly broad activation phrase can cause the skill to trigger on common financial questions, increasing unnecessary exposure to its file, network, and persistence behaviors. In an agent environment, overbroad matching can bypass user intent and expand attack surface through accidental invocation.
The natural-language description and operating rules are presented entirely in Chinese for user-facing behavior, while no opt-in or alternative locale is offered. This can violate language or locale policy when users have not chosen Chinese or when the agent is expected to adapt to user language preferences.
The batch script invokes capabilities that are not disclosed in the skill manifest, including additional data collection/reporting operations and a persistence-like save_daily action. Hidden or undocumented functionality increases the attack surface, defeats least-privilege expectations, and may cause the agent/operator to trigger behaviors they did not intend to authorize.
The function constructs many natural-language output messages and comments indicating end-user signals in Chinese, such as at L046-L055, L063-L069, and throughout the main-force analysis block. Because the file does not offer a language/locale option or document that the skill is intentionally China-market-only, this appears to force a specific language without user opt-in.
The module docstring states it 'completely relies on broker interfaces to obtain accurate data', which implies external data-source-only classification. In practice, the code also loads industry mappings from a local watchlist file and writes a persistent cache under /tmp, so behavior is not limited to broker/data-interface retrieval.
The module docstring and many comments/docstrings are exclusively Chinese-language, which reflects a language-specific skill experience without any opt-in or explanation that the skill is intentionally locale-bound. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
The classify_industry docstring says the function uses broker/data interfaces and returns 'unknown' if all interfaces fail, without guessing. However, _load_file_cache may prefill from watchlist.json before any API call, causing classify_industry to return a locally supplied sector classification even when no interface succeeds.
This file hard-codes user-facing confidence labels in Chinese (for example "中") and elsewhere returns many Chinese-language signals and alerts. Because the skill does not provide any opt-in, locale selection, or documented justification for forcing Chinese output, it violates the language/locale policy criteria.
No suspicious patterns detected.