A Share Portfolio

A股投资组合管理/持仓分析。当用户说"组合分析"、"持仓分析"、"portfolio"、"我的持仓怎么样"、"帮我看看组合"、"仓位管理"、"组合优化"、"风险分析"、"再平衡"、"行业暴露"时触发。对用户提供的持仓组合进行全面分析，包括持仓集中度、行业/风格暴露、风险指标、收益归因、再平衡建议。通过 cn-st...

Security Scan

The skill's description and analysis steps match a portfolio-analysis tool, but its runtime instructions depend on external Python scripts (cn-stock-data) and environment variables that are not declared or included, creating an incoherence and a potential execution/exfiltration risk.

Purpose & Capability

The stated purpose (A-share portfolio analysis) aligns with the steps in SKILL.md. However SKILL.md expects a local helper (SCRIPTS="$SKILLS_ROOT/cn-stock-data/scripts") and execution of python scripts (cn_stock_data.py). The skill package declares no required binaries, no dependency on Python, and does not include those scripts—this mismatch is unexplained and could lead to the agent executing code outside the skill's scope.

Instruction Scope

Runtime instructions explicitly tell the agent to run external Python scripts located via $SKILLS_ROOT/cn-stock-data/scripts. Those scripts are not part of this skill bundle. Executing external scripts at runtime can perform arbitrary I/O or network calls (including exfiltration) unrelated to the user's intent. The SKILL.md does not limit or audit what those scripts do; it also references other skills for deeper analysis, increasing cross-skill reach.

Install Mechanism

No install spec and no code files are included, which minimizes direct install risk. However, because the runtime expects external scripts, the lack of included code is itself a concern: the skill will fail unless a cn-stock-data component exists in the environment, and that external component becomes the real execution surface to review.

Credentials

The skill declares no required environment variables or credentials, which is appropriate for portfolio analysis. But SKILL.md uses $SKILLS_ROOT and presumes a Python runtime; these are implicit environment dependencies that are not declared. The skill promises to keep user holdings 'in-session' but provides no technical enforcement; if the referenced scripts perform network requests, user data could leave the session.

Persistence & Privilege

The skill is not marked always:true and is user-invocable only, which is appropriate. It does not request system-wide configuration changes or persistent privileges in its manifest.

What to consider before installing

This skill appears to be a legitimate portfolio-analysis helper, but the SKILL.md requires running external Python scripts at $SKILLS_ROOT/cn-stock-data/scripts that are not included or declared. Before installing or using it: 1) Verify whether a trusted 'cn-stock-data' component exists in your environment and inspect its code (cn_stock_data.py) to ensure it only fetches stock data and does not send portfolio data elsewhere. 2) Confirm a safe Python runtime is available and that $SKILLS_ROOT points to a trusted directory. 3) Ask the publisher for source code or for the missing dependency to be bundled or documented. If you cannot verify the external scripts, run the skill only in a sandboxed environment or treat it as untrusted, because executing undeclared scripts may expose your portfolio data or system to arbitrary actions.

数据源

SCRIPTS="$SKILLS_ROOT/cn-stock-data/scripts"

# 各持仓股行情
python "$SCRIPTS/cn_stock_data.py" quote --code [CODE1],[CODE2],[CODE3],...

# 各持仓股财务指标
python "$SCRIPTS/cn_stock_data.py" finance --code [CODE]

# 各持仓股K线（组合收益计算）
python "$SCRIPTS/cn_stock_data.py" kline --code [CODE] --freq daily --start [起始日期]

# 大盘指数（基准对比）
python "$SCRIPTS/cn_stock_data.py" kline --code SH000300 --freq daily --start [起始日期]

# 北向资金（外资对持仓的态度）
python "$SCRIPTS/cn_stock_data.py" north_flow

Workflow (6 steps):

Step 1: 持仓信息确认

收集用户持仓信息：

代码	名称	持仓数量(股)	成本价(元)	买入日期

如果用户只给出股票代码和大致比例，也可以基于比例分析。

Step 2: 持仓快照

通过 cn-stock-data quote 获取最新行情，计算：

代码	名称	现价	成本价	持仓市值(元)	占比(%)	盈亏(%)	盈亏额(元)

汇总：总市值、总盈亏、加权平均收益率

Step 3: 组合特征分析

集中度分析：

• 前 3 大持仓占比
• 前 5 大持仓占比
• HHI 指数（持仓集中度）
• 判断：过度集中 / 适度集中 / 分散

行业暴露：

行业	持仓占比(%)	沪深300权重(%)	超配/低配

风格暴露：

维度	组合加权平均	沪深300	偏向
PE(TTM)			价值/成长
PB
市值(亿)			大盘/中小盘
ROE(%)			质量
股息率(%)			红利

Step 4: 风险分析

个股风险：

• 任一持仓占比 > 30%：集中风险
• 持仓股的资产负债率 > 70%：财务风险
• 持仓股近期大幅下跌 > 20%：回撤风险
• ST 或负面新闻：特殊风险

组合风险：

• 行业集中度：前 1 行业占比 > 50% = 高风险
• 相关性风险：多只持仓属同一板块/主题 = 分散不足
• 估值风险：组合加权 PE 显著高于市场 = 估值偏高

Step 5: 优化建议

基于分析结果给出建议：

• 减仓：过度集中的个股/行业
• 加仓：低配的行业/补充分散性
• 替换：基本面恶化的持仓
• 再平衡：偏离目标配置的调整

Step 6: 输出

风格说明

维度	formal（机构组合报告）	brief（个人持仓复盘）
篇幅	4-8 页	1-2 页
持仓明细	完整表格 + 各股核心指标	持仓快照表
行业暴露	完整 vs 基准对比	Top 3 行业
风格分析	多维度雷达图描述	PE/市值一句话
风险分析	详细（个股+组合+情景）	核心风险 2-3 条
优化建议	详细再平衡方案	简要建议
免责声明	需要	不需要

关键规则

1. 用户数据保密：持仓信息是敏感数据，分析仅在当前会话中进行
2. 基准对比：默认基准为沪深300，用户可指定其他基准（中证500/创业板指等）
3. 不做精确收益预测：给出风险提示和优化方向，不预测组合未来收益
4. 区分建议的优先级：高风险问题（过度集中/财务风险）优先于优化建议（再平衡）
5. 尊重用户策略：如果用户有明确的投资策略（如集中持仓），不强行建议分散
6. 与其他 skill 联动：对组合中个股可用 a-share-earnings-analysis 深入分析、a-share-technical 看技术面、a-share-thesis 梳理持仓逻辑

使用示例

示例 1: 基本使用

# 调用 skill
result = run_skill({
    "param1": "value1",
    "param2": "value2"
})

示例 2: 命令行使用

python scripts/run_skill.py --input data.json