HK IPO Profile and Watchlist Manager

Manage Hong Kong IPO user preferences and watchlists, including risk profile, default output, budget, financing preference, and tracked symbols. Use when the...

Security Scan

The skill's code, install spec, and runtime instructions align with its stated purpose (managing HK IPO profile and watchlists); it requires a local CLI runtime and reads/writes config files in ~/.hkipo-next and performs expected network requests to public data sources, but requests no unrelated credentials.

Purpose & Capability

Name/description (profile & watchlist manager) match the included runtime and CLI commands (profile show/set, watchlist add/remove) and declared config paths (~/.hkipo-next/config/profile.json and watchlist.json). The heavy code bundle implements many IPO data adapters used for decision support, which is reasonable for the stated purpose.

Instruction Scope

SKILL.md instructs the agent to run the provided CLI via 'uv run --directory runtime/hkipo-next hkipo-next ...' and explicitly to read and then modify files under ~/.hkipo-next. The included code performs outbound HTTP requests to various public data sources (examples: aipo.myiqdii.com, aastocks.com, hkex, qt.gtimg.cn, suggest3.sinajs.cn) and may use WebSocket for realtime data — this is consistent with fetching IPO data but is network-active and will transmit/receive data to third-party endpoints. No instructions request unrelated system files or secrets, but the skill will read/write the declared local config files.

Install Mechanism

Install uses a Homebrew formula named 'uv' to provide the required binary. Homebrew installs are a standard mechanism and lower risk than arbitrary downloads, but the exact identity/source of the 'uv' formula is not shown here; verify the Homebrew tap/formula origin before installing. The runtime files are included in the bundle (runtime/hkipo-next), so no remote code download is required at runtime beyond standard package dependencies declared in pyproject.toml.

Credentials

The skill declares no environment variables or external credentials and only requires local config paths under the user's home directory for profile/watchlist data. The lack of requested secrets is proportional to the skill's functionality. Note: the code performs unauthenticated scraping/API calls to public services (some require per-request tokens obtained by scraping pages), but no secret environment variables are requested.

Persistence & Privilege

always:false (no forced presence). The skill stores state under ~/.hkipo-next (declared) which is appropriate for a profile/watchlist manager. It does not request system-wide privileges or modify other skills' configs. Autonomous invocation is permitted (platform default) but does not combine with other privilege red flags.

Assessment

This skill appears coherent for managing HK IPO preferences and watchlists. Before installing, consider: 1) you will install a Homebrew formula named 'uv'—verify the formula/tap is the one you expect; 2) the skill will read and write files under ~/.hkipo-next (profile.json and watchlist.json) — back them up if needed and inspect their contents; 3) the runtime makes outbound HTTP/WebSocket calls to public data sources (aipo.myiqdii.com, aastocks.com, hkex, qt.gtimg.cn, suggest3.sinajs.cn, etc.), so ensure you’re comfortable with that network activity; 4) no cloud credentials or other secrets are requested by the skill, which is good; 5) if you want extra caution, review the bundled runtime code (runtime/hkipo-next) locally or run the CLI in a restricted environment/container before granting it access to your normal user home directory.

Use this skill for stateful personalization.

Runtime

This publish bundle includes the required CLI runtime under runtime/hkipo-next.

From the skill folder:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next ...

By default the CLI stores profile and watchlist state under ~/.hkipo-next. Read current state before changing it.

Workflow

1. Use profile show before profile set when current state matters.
2. Update only the fields the user asked to change.
3. Batch multiple symbol additions or removals in one watchlist command.
4. Use --format json if another skill will consume the result.

Commands

Show the effective profile:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next profile show --format json

Set profile fields:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next profile set \
  --risk-profile balanced \
  --default-output-format markdown \
  --max-budget-hkd 80000 \
  --financing-preference auto \
  --format json

List the watchlist:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next watchlist list --format json

Add symbols:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next watchlist add 2476 2613 --format json

Remove symbols:

cd <skill_dir>
uv run --directory runtime/hkipo-next hkipo-next watchlist remove 2476 --format json

Output Cues

• profile.sources explains where each effective field came from.
• watchlist.changed_symbols is the authoritative mutation result.
• watchlist.symbols is the final normalized state after the operation.

Companion Skills

• Use $hkipo-decision-engine for batch --watchlist.
• Use $hkipo-parameter-manager when the user wants personalized score tuning.