agent-stock

用于股票行情查询与分析的命令行技能。用户提到 stock 命令、股票代码、最新资讯、市场概览、K 线或配置管理时调用。

Security Scan

The skill is coherent with its stated purpose (a stock CLI): it fetches market data from public finance endpoints, computes indicators, and stores a small local config — nothing requests unrelated credentials or unexpected system access.

Purpose & Capability

Name/description match the implementation: commands for quote, plate, news, kline, search, history and config are implemented. Network calls go to public finance endpoints (qq/gtimg/baidu) which is expected for a stock-data tool. No unrelated credentials or binaries are requested.

Instruction Scope

SKILL.md instructs the agent to invoke the 'stock' CLI for stock-related queries only. The code only reads/writes a small local config and calls remote data APIs; it does not instruct reading arbitrary user files or exfiltrating secrets.

Install Mechanism

The registry metadata lists no install spec (instruction-only), but the repository contains a pyproject and package code (entry point 'stock'), so installation would normally be via pip/uv/pipx. This is not inherently risky, but the mismatch (no declared install step) is worth noting: installing executes third-party package code locally, so only install from a trusted source.

Credentials

The skill declares no required env vars or secrets. The code does honor an override for config path via an env var (config_store uses 'stock_CONFIG_PATH'), which is a reasonable convenience. Also note tests set 'STOCK_CONFIG_PATH' (different case), which is a minor implementation/test inconsistency but not a credential leak. No API keys, tokens, or unrelated env access are requested.

Persistence & Privilege

always:false and normal autonomous invocation settings — appropriate. The skill saves a small JSON config in the user's home (~/.agent-stock/config.json) by default (or at the path from the env var). This is standard for a CLI but does create persistent files in the user profile.

Assessment

This skill appears to do what it says: fetch public stock data, compute indicators, and store a small local config. Before installing, confirm the package source (the pyproject points to a GitHub repo) and only install from a trusted release. Be aware that queries (stock symbols) are sent to third‑party services (qq/gtimg/baidu), so avoid sending sensitive identifiers you wouldn't want transmitted. Note the config file is written to your home directory by default (or to a path you set via the STOCK_CONFIG_PATH/stock_CONFIG_PATH env var), and there is a minor env-name inconsistency between code and tests — harmless but worth noting. If you need higher assurance, review the package code locally before installation or run it in an isolated environment.

agent-stock — 股票行情命令行技能

命令名： stock 适用场景： 查询股票实时行情、个股相关板块涨跌幅、个股最新资讯、市场快照、历史数据、日 K 技术指标，以及查看/设置默认市场配置。

何时调用

• 用户要求“查某只股票价格/涨跌幅/市值”
• 用户要求“看某只股票相关地域/行业/概念板块涨跌幅”
• 用户要求“看某只股票最新资讯/新闻摘要”
• 用户要求“看市场总览/指数表现”
• 用户要求“搜股票代码或名称”
• 用户要求“查历史数据（1d/5d/1m/3m/6m/1y/5y）”
• 用户要求“看日 K + 技术指标（EMA/BOLL/KDJ/RSI）”
• 用户要求“查看或修改 agent-stock 配置（market）”

全局参数

• -v, --version：显示版本

命令总览

命令	说明	关键参数
stock quote <symbol>	查看单只股票实时行情
stock plate <symbol>	查看个股相关板块涨跌幅
stock news <symbol>	查看个股最新资讯
stock kline <symbol>	查看日 K 线 + 技术指标

常用示例

• stock quote 600519
• stock plate 600519
• stock news 600519
• stock quote 00700
• stock quote us.aapl
• stock kline 600519