Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward stock quote lookup tool that makes disclosed, purpose-aligned finance data requests and does not show hidden persistence, credential access, or destructive behavior.
Before installing, users should know this skill sends the entered stock name or code to public finance services for lookup and returns Chinese-formatted output. It appears suitable for quote lookup, but it should not be treated as financial advice or as a private/offline tool.
The skill instructs the agent to run a Python script that fetches stock data from Sina Finance, which implies outbound network access, but the manifest does not declare any tool scope or permissions. Undeclared network capability weakens governance and user/host visibility, making it easier for a skill to perform unexpected external communication or expand behavior beyond what reviewers expect.
The activation description is broad enough to trigger on generic stock-price or market-data requests, which can cause the agent to invoke this skill in cases outside its narrow intended workflow. Overbroad activation increases the chance of unintended code execution and unnecessary network calls, especially in multi-skill environments where more appropriate or safer tools may exist.
The skill content, trigger conditions, and usage examples are entirely in Chinese and imply interaction in that language, but there is no statement that this is optional or limited to a Chinese-language context. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
This Python skill contains user-facing docstrings, status messages, usage text, and formatted results entirely in Chinese, and it does not offer any language selection or opt-in. That creates a natural-language locale policy issue because the skill effectively forces one language for all users without documenting a justified region-specific limitation.
The user-facing text printed in the main block says 'A股股票价格查询' and presents the tool as an A-share stock price query utility, while the implementation explicitly handles '美股' and '港股' in get_stock_price and search_stock_code. This is an intent/documentation mismatch because the inline usage messaging understates the actual supported scope.
No suspicious patterns detected.
