Security audit
qiaofuture-boston-stock-king
Security checks for vulnerabilities and agentic risk
Overview
The skill's code and instructions largely match its stated purpose (gamified stock picks + 'care' features) but it collects personal data, encourages payments via external QR images, and includes a few odd implementation choices (NO_PROXY='*', plaintext local storage) that warrant caution.
This skill appears to do what its description says, but pay attention before installing or using: 1) It asks users to provide phone numbers, postal addresses and personal photos and stores them unencrypted in local JSON files — avoid supplying sensitive personal data unless you trust the publisher. 2) The skill explicitly solicits money via QR codes hosted on an external COS URL and even embeds payment QR marks into generated images — be cautious of unsolicited payment requests and verify the payment destination independently. 3) The code sets NO_PROXY='*' (unusual) and uses external APIs (新浪财经 and an external COS host); if you care about network isolation, run the skill in a sandboxed environment and monitor outbound requests. 4) The phone-call feature is implemented as an integration (ai-calls-china-phone) — review that dependency before installing it, since it would handle telephony and may incur costs or require additional permissions. 5) If you decide to proceed: review the scripts yourself (or have someone you trust do so), remove or sandbox any automatic ordering/phone-calling behavior, and avoid uploading sensitive photos or addresses until you’re comfortable with how they’re used and stored.
Static analysis
No suspicious patterns detected.