Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a disclosed Chinese fund-analysis tool, but it has unsafe path handling that can write reports outside its intended folder and some unreliable investment-report output.
Install only in an isolated working directory or virtual environment, pin AKShare before installing, and use normal fund-code inputs only. Do not run it with untrusted fund codes, untrusted environment variables, or elevated filesystem permissions. Treat the investment report as historical analysis, not actionable financial advice, especially because some generated sections can be inconsistent or incomplete.
scripts/utils/file_utils.py:24Unsanitized Fund Code Allows Filesystem Path Traversal and Arbitrary Output Placement
SKILL.md:151Unpinned AKShare Installation Creates Supply-Chain Exposure
The declared description presents a broad end-to-end fund/ETF annual analysis and investment strategy generation skill. The supplied code chunk only performs one narrow analytical subtask: calculating holding-period performance statistics from input data. It does not fetch data, manage directories, perform incremental analysis, generate structured reports, or produce strategy/risk recommendations. While this module could be a supporting component of the larger skill, considered in isolation it does not accurately represent the declared functionality and has a materially narrower primary purpose.
The declared description promises a broad end-to-end fund/ETF annual analysis and strategy generation capability, including data acquisition, report generation, and actionable investment guidance. The supplied code chunk is much narrower: it only analyzes already-provided data to compute monthly and quarterly summary statistics and rank months by historical return. This is a materially different and significantly reduced primary purpose compared with the declared skill, so it should be flagged as a mismatch.
The supplied code is a narrow analytical helper for seasonal monthly return estimation. Its primary behavior is to sort input data, calculate daily returns, aggregate them by calendar month, and output monthly average return stats. This is only a small subcomponent of the much broader declared skill. The declared description promises an enhanced end-to-end fund/ETF analysis workflow with AKShare data retrieval, incremental processing, directory management, annual走势 analysis, investment timing, expected returns, structured strategy generation, and risk guidance. None of those broader capabilities appear in this code chunk. Because the actual code’s purpose is materially narrower and different from the declared overall functionality, this should be flagged as a mismatch.
该代码块的实际功能是一个底层技术分析组件，聚焦于波段/拐点识别和回撤计算，属于金融时间序列分析中的局部子能力。相比之下，声明描述的是一个端到端的基金/ETF年度分析与投资策略生成技能，范围明显更大，包含数据采集、报告生成、策略建议等高层功能。当前代码既没有外部数据访问，也没有策略生成或结构化报告输出，因此其主要目的与声明不一致。虽然“走势分析”与声明主题有关，但只覆盖了很小一部分，且缺失了声明中的核心能力，构成实质性描述不匹配。
The declared description promises an enhanced end-to-end fund/ETF analysis skill with data acquisition via AKShare, incremental analysis, and a rich structured strategy report including actionable buy/sell timing, estimated returns, three strategy options, and risk management guidance. The supplied code only performs basic annual statistics over an input CSV and emits a Markdown skeleton. Several major promised features are absent or stubbed out with placeholder text ('请参考 SKILL.md'). The code’s core purpose is related to fund annual trend analysis, so it is not unrelated, but the implemented behavior is materially narrower than the declared functionality.
The skill advertises behaviors that involve environment-variable access plus reading and writing files, but it does not declare any explicit tool scope or permissions boundaries. In agent environments, missing scope declarations increase the chance that the skill is invoked with broader capabilities than users expect, enabling unintended filesystem writes or environment access.
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions, recommendations, and warnings only in Chinese, with no user opt-in, alternate language, or justification that the skill is intended solely for a Chinese-speaking audience.
In the buy-in section, the report says the current position is in a 'historical middle region' at L212, while the sell-out section says it is in a 'historically relatively high region' at L268. This is not just incomplete analysis; it is an active contradiction in the document’s guidance about the same current state.
The entire skill file is written in Chinese and does not indicate any language choice, fallback, or user opt-in. Under the stated policy, forcing a specific language or locale without offering a choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
The report states the fund is at the 95th historical percentile and in a relative high zone, but elsewhere labels the current position as a middle area. In an investment-analysis skill, this contradiction can mislead downstream users or agents into taking the wrong trading action because risk posture depends directly on whether the asset is near highs or fairly valued.
The method docstring and the generated report text throughout the file are written exclusively in Chinese, indicating the skill forces a specific language output. The policy for natural-language violations applies to all file types and requires either user opt-in or clear justification for a locale constraint, neither of which appears here.
The method documentation says it returns 'monthly average returns across years', which implies month-by-month aggregation at the year level. However, the code actually aggregates daily returns by calendar month across the whole dataset and scales the average by 21 trading days, which is a different analysis than documented.
The code returns user-facing status text in Chinese ('上升波段中', '下降波段中') with no option to select language and no indication that the skill is intentionally limited to a Chinese locale. This is a natural-language policy issue because it imposes a specific language on outputs without user opt-in.
This Python file contains its top-level docstring entirely in Chinese, and the CLI usage/help text is likewise presented only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
The manifest describes a skill that generates structured reports including buy/sell timing analysis, estimated returns, three operation plans, and risk-management recommendations. In this file, the generated report only computes annual summary statistics and fills the core strategy sections with '请参考 SKILL.md' placeholders, so the implemented behavior falls materially short of the claimed analytical output.
The script writes to a path derived from the FUND_ANALYSIS_BASE_PATH environment variable without constraining it to an expected safe directory. In agent or automation contexts, environment variables are often attacker-influenced or misconfigured, so this can enable arbitrary file write outside the intended investment_analysis folder, potentially overwriting files the process can access.
# Default to ./investment_analysis/<fund_code>_analysis.md but allow override via env var
base_path = os.environ.get('FUND_ANALYSIS_BASE_PATH', 'investment_analysis')
output_file = Path('.') / base_path / f"{fund_code}_analysis.md"
with open(output_file, 'w', encoding='utf-8') as f:
f.write(report)
print(f"报告已保存至: {output_file}")
This code explicitly configures Chinese fonts and documents the behavior as a default requirement, indicating the module is designed around a fixed locale. Under the policy, forcing a specific language or locale without offering a user choice or documenting a justified regional constraint is a natural-language policy violation.
The skill documents automatic creation of directories, compatibility copies, and intermediate artifacts, but does not present this as a clear operational warning to users. In agent-driven workflows, understated write behavior can lead to accidental persistence of sensitive financial inputs or cluttering unintended locations, especially when the base path is environment-controlled.
At L046, the summary states '季节性规律: 待分析具体数据', but later sections provide monthly seasonality tables, best/worst months, and related strategy guidance at L85-L119 and L235-L253. This directly contradicts the document’s own stated analysis status.
The line '从高点回撤{max_drawdown * 0.6:.1f}%时考虑止损' contains an unrendered formatting expression, indicating the value was not actually computed before publication. In a finalized investment analysis report, this contradicts the document’s apparent claim that all recommendations are concrete outputs derived from the data.
The rendered markdown exposes unresolved template code ({max_drawdown * 0.6:.1f}%) instead of a computed stop-loss threshold. In a financial decision-support report, this can cause users to miss or misapply a risk limit, weakening the report's core safety guidance.
This code embeds user-facing month labels in a specific language ('1月' through '12月'). The file does not indicate that the skill is region-specific or provide any opt-in or localization mechanism, which can violate language/locale policy requirements.
This Python file contains user-facing natural-language strings such as the module description, usage examples, and argparse help text only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
The comment describes a default of './investment_analysis/<fund_code>_analysis.md' with an override via environment variable, implying a controlled variation of that location. However, the code inserts the environment-provided base path directly into the output path construction, allowing output outside the stated default directory structure if the variable contains another path.
No suspicious patterns detected.