Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese-language stock research skill that gathers market data and recent news to produce analysis, with no hidden execution, persistence, or credential handling found.
Before installing, treat the generated ratings as investment research, not guaranteed financial advice. Confirm the data sources and regulatory-news search results, especially before acting on buy/sell recommendations. Be careful with the optional manual upgrade deletion command and run it only if that old skill path is really the one you intend to remove.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
### 升级路径（适用从 v3.x 升级的用户）
1. 删除本地旧版本：`rm -rf skills/stock-research-team`
2. 安装 v4：`clawhub install tanteng-stock-research`
3. 触发关键字不变（"分析 X 股票"），但失去 `mode: full` 的多 agent 升级能力
4. 如确需多 agent 深度复盘，回到上游 `stock-research-team` 原版
The manifest description and operational instructions are written to require Chinese-language stock analysis behavior, including fixed Chinese search queries and output conventions, without stating that the user can choose another language. This is a natural-language locale policy concern because the skill appears to impose a specific language by default rather than offering language selection or documenting a justified locale restriction.
The changelog states that the trigger keyword remains "分析 X 股票", but it does not define boundaries, exclusions, or where this phrase should apply. Because this is a manifest/markdown-context trigger description without scope constraints or negative examples, it risks unintended invocation from ordinary stock-analysis requests.
The file title and all operational guidance are written exclusively in Chinese, with no indication that users may choose another language or locale. This creates a natural-language policy concern because the skill appears to impose a specific language by default rather than offering opt-in or alternatives.
No suspicious patterns detected.