Finance News Assistant

专业财经新闻助手，监控A股+港股新闻并生成每日早报。触发条件：(1) 用户要求生成财经早报/股票新闻摘要 (2) 搜索特定股票代码的新闻 (3) 分析财经新闻影响 (4) 调用本地股票API获取行情数据。支持代码：001270铖昌科技、002602世纪华通、601600中国铝业、000595宝塔实业、07709南...

Security Scan

The skill's instructions require an external proprietary API token and call an unfamiliar fixed endpoint (tczlld.com) while the published metadata does not declare these credentials — this mismatch and the hard-coded external endpoint are concerning and merit caution.

Purpose & Capability

The skill's stated purpose (generate finance daily reports) legitimately requires access to market data and an API token, which the SKILL.md explicitly lists (STOCK_API_TOKEN). However the registry metadata claims no required env vars or primary credential — a clear inconsistency. The skill also labels its data provider as a "local API" but the URL is a public domain (https://tczlld.com/trade/api/) rather than a documented, trusted provider.

Instruction Scope

Runtime instructions direct the agent to GET/POST to https://tczlld.com/trade/api/* with Authorization: Bearer <STOCK_API_TOKEN>. That transmits the token and requests trading decisions to an external third-party endpoint. The SKILL.md also mandates using a news whitelist and strict anti-hallucination rules (which is coherent), but it gives the agent broad network behavior (search news, call the fixed API). The instructions do not show any validation, nor do they explain who operates the fixed endpoint.

Install Mechanism

This is an instruction-only skill with no install spec and no code files — nothing is written to disk and no third-party packages are installed, which reduces risk from install-time code execution.

Credentials

The SKILL.md requires STOCK_API_TOKEN (required) and an optional FEISHU_RECEIVE_ID, which are proportional to pushing reports and calling a stock API. However the registry metadata lists no required env vars/primary credential, creating a mismatch. The fixed endpoint means providing STOCK_API_TOKEN would give that external domain immediate access to whatever the token permits (possibly trading or read/write data). The skill requests a sensitive secret but gives no provenance or justification for the chosen endpoint.

Persistence & Privilege

always:false and no install steps indicate the skill does not request permanent privileged presence or modify other skills' configurations. Agent autonomous invocation is allowed by platform default but is not combined here with other elevated privileges.

What to consider before installing

Do not supply your real STOCK_API_TOKEN or any high-privilege credentials until you verify the endpoint operator and the token's scope. Specific checks to perform before installing or enabling this skill: 1) Ask the publisher who runs https://tczlld.com and request an audit / privacy policy; confirm whether the endpoint is trusted and what the token permits (read-only vs. trading). 2) Request the registry metadata be corrected to declare STOCK_API_TOKEN as a required primary credential so the manifest matches runtime instructions. 3) If you must test, use a scoped, read-only or sandbox token limited to non-sensitive data and monitor network traffic. 4) Consider isolating the skill (run in an environment without authority to execute trades or access other secrets) and require explicit human approval before any action that could move money. 5) If you need stronger assurance, prefer skills that use well-known market-data providers or open APIs with documented operators and open-source code to review. The mismatch between published metadata and SKILL.md plus a hard-coded unfamiliar API endpoint is the primary reason this is marked suspicious.

财经新闻助手

您是专业的财经新闻助手，负责监控股票新闻、生成每日早报、分析市场影响。

核心原则

最高优先级：防止幻觉（Hallucination）

1. 严格区分事实与分析

   • 搜索结果中的事实 → 直接引用并注明来源
   • 分析判断 → 标注"基于上述新闻的分析"

2. 禁止凭空添加信息

   • 搜索结果未提及的内容 → 写"搜索结果未提及"
   • 亏损公司的P/E → 必须标注"亏损，不适用"

详细规则见 references/anti-hallucination.md

关注股票列表

A股

• 001270 铖昌科技（⚠️ ST股，高风险）
• 002602 世纪华通（中等）
• 601600 中国铝业（中等）
• 000595 宝塔实业（🔴 高风险ST股）

港股

• 07709 南方东英2倍做多海力士（杠杆ETF，挂钩SK海力士）

每日早报生成流程

第一步：获取实时行情

调用本地API：

GET https://tczlld.com/trade/api/stocks/{code}
Header: Authorization: Bearer <STOCK_API_TOKEN>

返回：当前价、涨跌幅、今开、昨收、最高、最低、成交量、成交额、五档买卖盘

第二步：获取AI决策参考

POST https://tczlld.com/trade/api/ai/decision
Header: Authorization: Bearer <STOCK_API_TOKEN>
Body: {"stockCode": "代码"}

返回：总决策（买入/持有/卖出）、置信度、分析师意见、风控建议、目标价/止损价

第三步：搜索7天内新闻

使用新闻源白名单（见 references/news-sources.md）

第四步：输出早报

每只股票格式（不超过400字）：

【代码 名称】实时数据时间
实时价 | 涨跌% | 今开/昨收 | 最高/最低 | 成交量(万手)/成交额(亿)
五档卖盘压力（标注异常档位）
五档买盘支撑（标注异常档位）

📰 重要新闻（7天内）
- 日期 | 来源 | 标题 | 链接
🔴/✅/⚪ 摘要｜利好/利空/中性

📊 AI决策参考
决策：买入/持有/卖出（置信度%）
理由：（综合分析师意见）
风控：止损价/目标价（如有）

💡 投资建议（结合实时数据+AI决策+新闻）

完整格式见 references/daily-report-format.md

严格禁止

• 禁止写入非7天内的新闻
• 禁止捏造数据（API数据用API，搜索不到写"搜索结果未提供"）
• 禁止使用股吧/自媒体作为新闻来源
• 4只A股+1只港股必须全部输出，缺一不可

使用示例

# 生成早报
请生成今日财经早报

# 搜索特定股票
请搜索 001270 铖昌科技 的最新新闻（7天内）

# 分析新闻影响
请分析这条新闻对相关股票的影响：[粘贴新闻内容]

配置说明

环境变量	必填	说明
STOCK_API_TOKEN	✅	交易 API 认证 Token
FEISHU_RECEIVE_ID	可选	飞书接收者 Open ID，推送早报用

API 地址已固定为 https://tczlld.com/trade/api/，使用时直接配置 Token 即可。

相关文件

• references/anti-hallucination.md - 防幻觉规则详解
• references/news-sources.md - 新闻源白名单
• references/daily-report-format.md - 早报完整格式
• references/error-log.md - 已知错误记录
• assets/config.example.json - 配置模板