Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed helper for public Chinese stock-market data, with no evidence of hidden access, persistence, credential use, or destructive behavior.
Before installing, treat this as a China-market stock-data helper that may contact 同花顺/问财 and may depend on page structure that can change. The included scripts currently return placeholder or empty data, so verify results independently and do not rely on them as financial advice.
声明描述的是一个同时覆盖“题材/概念板块 + 人气排名 + 综合 Markdown 报告”的技能，但给出的代码块只对应“个股人气排名”这一子功能，而且还是占位实现：fetch_popularity_rank() 仅构造元数据和空 stocks 列表，parse_snapshot() 也未完成实际解析逻辑。format_markdown() 只会输出人气排名表，不包含任何题材/概念字段。因此，代码实际行为明显窄于且不同于声明用途，属于描述与实现不一致。
声明描述的是一个可查询题材/概念分类、获取人气排名并生成报告的技能。但提供的代码实际上没有执行这些核心功能：fetch_stock_themes 只返回带默认空字段的模板结果，注释中提到需借助 browser 工具访问同花顺页面，但当前代码并未访问网络或调用该工具；parse_snapshot 也只是占位函数，没有解析逻辑；整个脚本仅做命令行参数校验并输出空结果。因此，代码实际行为与声明用途存在明显不一致，且缺少声明中的多个关键能力。
The natural-language content of the skill README is entirely Chinese, and there is no indication that the skill is intentionally restricted to Chinese-speaking users or China-specific workflows. Per the policy, forcing a specific language without user opt-in can be a language/locale policy violation.
This markdown file states that the skill gets latest data from 同花顺问财, which implies outbound network access to a third-party service. The README provides usage examples but does not disclose any privacy, connectivity, or third-party access warning to the user.
The package description is written only in Chinese, and the keywords likewise target a Chinese-language/China-market context without indicating that the skill is region- or locale-specific by design. Under the policy, language or locale constraints should be documented and justified or offered as an explicit user choice.
This markdown file contains all user-facing instructions and examples in Chinese, and it does not indicate that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
This code file contains natural-language strings in a single fixed language, including the module docstring and CLI help text, which can amount to a language/locale policy issue when no opt-in or justification is provided. There is no indication that the skill is intentionally region-specific or that users may choose another language.
The argparse description and help messages are all hard-coded in Chinese, which is a natural-language locale constraint visible to end users. The file does not offer a language selection mechanism or explain that the tool is intentionally limited to a Chinese-speaking context.
This code file contains natural-language instructions and examples exclusively in Chinese, and later user-facing error messages are also Chinese-only. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
No suspicious patterns detected.
