Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent fund-analysis skill that retrieves and visualizes fund data through disclosed fof99 MCP tools, with no evidence of hidden execution, persistence, mutation, or exfiltration beyond expected data lookups.
Before installing, make sure you are comfortable with fund names, codes, and any portfolio identifiers being queried through the fof99 MCP data platform. Treat generated analysis as informational rather than investment advice, and ask for locale or color-format changes if you do not want Chinese market presentation conventions.
The skill description and trigger guidance are broad enough to activate on many generic finance-related queries, which can cause the agent to invoke this skill in situations where the user did not actually request fund analysis. That increases the chance of unnecessary tool use, disclosure of financial context to external MCP services, and user confusion from incorrect routing.
The instructions require use of the Chinese market convention '红涨绿跌' and later prescribe Chinese typography and presentation defaults, effectively forcing a locale-specific output style. Because the file does not offer opt-in, alternative locale handling, or explain that this is only for a China-specific deployment, it creates a natural-language locale policy concern.
No suspicious patterns detected.
