Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-style trading expression skill with no hidden code or persistence, but its trading examples and MCP call should be treated as illustrative and user-directed.
Install only if you want FactorLang syntax and strategy-expression help. Review generated trading rules carefully, require explicit confirmation before any MCP/backtest or execution-related tool use, and treat all examples as technical templates rather than financial recommendations.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# FactorLang表达式系统规范 v1.0
## 量化因子表达式语言参考手册
### —— 策略开发、因子计算、信号生成
The description is broad enough to activate on common requests about writing expressions, querying syntax, or designing strategies, which increases the chance the skill is invoked in contexts beyond narrow reference lookup. Overbroad matching can expose users to prescriptive trading logic and operational guidance when they may have requested only general help, increasing the risk of inappropriate automation or policy bypass through unnecessary skill activation.
The skill is described as a reference/specification, but it also includes concrete MCP server invocation guidance that can steer an agent from passive documentation into operational backtesting or execution behavior. This expands the skill’s effective authority and can cause unintended tool use if an orchestrator or downstream agent treats the examples as actionable instructions rather than illustrative content.
The statement that the skill should be 'automatically invoked' whenever users need expression writing, strategy development, query syntax, or trading strategy design is overly permissive and lacks exclusion conditions. In practice, this can cause automatic injection of powerful domain instructions into many finance-related conversations, making it easier for an agent to overstep from answering questions into generating trading rules or operational workflows.
The document provides concrete buy/sell, stop-loss, take-profit, and position-management examples that a downstream agent could surface as actionable trading guidance without any disclaimer or warning about financial risk. In a skill explicitly meant for strategy development and signal generation, this increases the chance users interpret examples as recommendations, potentially leading to financial loss or unsuitable automated trading behavior.
No suspicious patterns detected.