Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward A-share stock quote tool that makes disclosed Sina Finance requests and does not show hidden persistence, credential access, or destructive behavior.
Install only if you are comfortable sending queried A-share stock codes to Sina Finance over the network. The skill does not need an API key and I found no hidden persistence or credential access, but users in restricted, regulated, or air-gapped environments should avoid live external quote tools unless that egress is approved.
The file's natural-language content forces a specific language/locale for users, which matches the policy-violation category when no opt-in or alternative is offered. There is no indication that the skill is intentionally restricted to Chinese-speaking users for compliance or region-specific reasons.
The file presents all user-facing instructions and operational notes only in Chinese. Under the stated policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.
The skill documentation clearly instructs use of a script that makes outbound requests to the Sina Finance API, but the skill metadata does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and policy-enforcement gap: an agent or reviewer may not realize the skill requires network access, and a broader runtime could permit unintended external communication.
This markdown file is entirely written in Chinese and presents the workflow as the default instruction set, with no indication that users may choose another language. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
The README states that the skill uses the Sina Finance API, but it does not clearly warn users that requested stock codes and associated request metadata will be transmitted to a third-party service. This is a real transparency/privacy issue because users may assume the skill operates locally or may not understand what data leaves their environment, though the exposed data here is typically low sensitivity.
The README describes use of the skill but does not clearly disclose that requested stock symbols are sent to Sina Finance, a third-party external service. While the transmitted data is low sensitivity in normal use, lack of disclosure can mislead users operating in restricted, privacy-sensitive, or air-gapped environments and cause unintended external data egress.
This code file contains natural-language descriptions and user-facing CLI help text exclusively in Chinese, which can constitute a language/locale policy violation when no user opt-in or language selection is provided. The issue is reinforced by later user-facing output strings that are also fixed to Chinese.
No suspicious patterns detected.
