Security checks across malware telemetry and agentic risk
This stock-analysis skill matches its stated purpose, but it needs review because crafted stock names or codes can be passed into local shell commands.
Review before installing. Use only plain stock names or standard ticker codes, avoid private portfolio details, and verify the westock-data dependency. The publisher should remove shell=True, pass subprocess arguments as arrays, validate ticker inputs, and clarify which macro and backtest features are actually implemented.
"""搜索股票"""
print(f"\n🔍 搜索股票: {self.stock_input}")
cmd = f"node ~/.workbuddy/skills/westock-data/scripts/index.js search '{self.stock_input}'"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
if result.returncode == 0:
output = result.stdout# 获取K线数据
cmd = f"node ~/.workbuddy/skills/westock-data/scripts/index.js kline {self.stock_code} daily {days} hfq"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
if result.returncode == 0:
try:end_date = datetime.now().strftime('%Y-%m-%d')
start_date = (datetime.now() - timedelta(days=days)).strftime('%Y-%m-%d')
cmd = f"node ~/.workbuddy/skills/westock-data/scripts/index.js technical {self.stock_code} ma,macd,kdj,rsi,dmi,vol,boll {start_date} {end_date}"
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
if result.returncode == 0:
try:64/64 vendors flagged this skill as clean.