Custom Morning Brief

================================。触发词：搜索, search, skill, 优化, 数据, data。

Security Scan

The skill's stated purpose (generate and push a morning brief) is plausible, but the runtime instructions reference reading local user files and calling external APIs and a fixed Feishu target without declaring required credentials or explaining scheduling — the pieces are inconsistent and could leak sensitive data.

Purpose & Capability

The SKILL.md describes generating and sending a morning brief to Feishu and pulling data from tianji-data, batch_web_search, hot.md, and USER.md. The registry metadata declares no required environment variables or credentials, yet the described functionality clearly needs API credentials (e.g., Tencent/tianji-data and Feishu) and access to local files. That mismatch (no declared creds/config despite needing them) is incoherent.

Instruction Scope

Instructions explicitly tell the agent to read local files (hot.md, USER.md) and call external data sources, then deliver the briefing to a specific Feishu channel/target (ou_fd61...). Reading a USER.md (likely containing holdings) and sending it offsite is sensitive behavior. The SKILL.md also mandates an automatic daily schedule but provides no safe guard, consent step, or mechanism for authentication — granting broad, under-specified scope.

Install Mechanism

This is an instruction-only skill with no install spec and no code files. That minimizes install-time risk (nothing downloaded or written during install).

Credentials

No environment variables or credentials are declared, yet the skill needs Feishu messaging credentials and likely Tencent/API keys for tianji-data and possibly search APIs. Lack of declared primaryEnv or required secrets is disproportionate and hides the sensitive permissions the skill requires. The hard-coded Feishu target suggests messages will be delivered to a predetermined recipient regardless of the installer.

Persistence & Privilege

The SKILL.md asks for an automated daily run (06:30 each trading day) and unconditional delivery to a specific Feishu target, but the skill metadata does not explain how scheduling or user consent is enforced. While always:false (it won't be force-included), the ability to autonomously send potentially sensitive data on a schedule is a notable privilege if the agent is allowed to invoke the skill without clear user approval.

What to consider before installing

Before installing, verify and control where your data will be read from and sent. Questions to resolve: (1) Where are hot.md and USER.md stored and what sensitive data do they contain? (2) Which credentials (Feishu token, Tencent/tianji-data API key, search API keys) are required and who will supply them — update the skill to declare those env vars explicitly. (3) Why is the Feishu target hard-coded to ou_fd61d5…? If you install, replace the hard-coded recipient with a configurable target or require explicit consent per send. (4) Confirm how the scheduled automatic runs are triggered and require an opt-in. If you cannot verify the destination and required credentials, treat this skill as risky and do not grant agent access to USER.md or production credentials.

定制晨报系统

================================

每天早上自动生成定制日报，推送到飞书 版本: 1.0 | 2026-04-03 | 依赖: tianji-data + batch_web_search + hot.md

---

晨报内容结构

每天 06:30 自动生成，08:00 前推送到飞书：

【玉衡晨报 · YYYY-MM-DD 星期X】

📊 今日大盘
上证：XXXX点 (±X.XX%)
深证：XXXX点 (±X.XX%)
创业板：XXXX点 (±X.XX%)
成交额：X.XX万亿
北向资金：[流入/流出] XX亿

🔥 昨日热点板块
1. [板块名] [+X.XX%] — [核心逻辑]
2. [板块名] [+X.XX%] — [核心逻辑]
3. [板块名] [+X.XX%] — [核心逻辑]

📋 持仓诊断（当前）
[股票名] [代码]：[X万股] | 成本：[¥X] | 现价：[¥X] | 浮亏：[¥XXX]

💡 今日重点关注
1. [宏观事件] — 对A股影响
2. [行业新闻] — 相关板块
3. [外盘行情] — 纳指/恒指/原油

🎯 今日操作建议
[买/卖/观望] + 具体理由

📅 本周重要日程
- 周X：XXXX财报发布
- 周X：XXXX政策会议

---

触发机制

时间	动作
每个交易日 06:30	自动生成晨报
发送至	飞书私信用户

---

数据来源

内容	来源
大盘数据	tianji-data（腾讯接口）
热点板块	hot.md 昨日记录
持仓诊断	USER.md
宏观事件	batch_web_search
外盘行情	腾讯接口（纳指期货/恒指）

---

配置

晨报发送到飞书，通过 message tool：

channel: feishu
target: ou_fd61d5ebc9af22913aa4c21c8e3cac14