Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently monitors China interest rates, fetches public rate data, and stores comparison data locally, with no evidence of hidden privilege use or malicious behavior.
Before installing, expect this skill to make outbound requests to public finance/rate websites and update its own local rates.json file when run. Consider narrowing the trigger phrases if accidental activation would be noisy, and verify the data before using it for financial decisions.
The trigger list includes very broad terms such as '利率', '今天利率', '利息', and '利率查询', which are likely to appear in ordinary financial conversations and can cause the skill to activate unintentionally. In an agent ecosystem, overbroad invocation increases the chance of irrelevant execution, unnecessary data fetching, notification noise, and possible routing away from a more appropriate skill.
This code file contains natural-language strings and documentation that are primarily Chinese, including the top-level script description and operational instructions. Under the policy rule, forcing a specific language without user opt-in is a locale-policy concern unless the tool clearly documents a justified region-specific constraint or offers a language choice.
The top-level documentation says '抓取失败时使用上次保存的数据（不发送错误通知）', implying an operational fallback to stored rates on fetch failure. In practice, the script loads historical data only for comparison, and if no new rates are obtained it prints a warning and exits at L269-L271 rather than using the saved data as the active fallback dataset.
No suspicious patterns detected.
