Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language stock news sentiment analysis skill with no bundled executable code and no evidence of hidden, persistent, destructive, or exfiltrating behavior.
Before installing, note that this free skill is documentation-only in the submitted package and may not work as written because the referenced Python script is not included. Use it for informational sentiment summaries only, not investment advice, and avoid providing private credentials beyond any API key you intentionally configure for your agent environment.
The skill metadata forces Chinese-language presentation via displayName and Chinese-first content without indicating user choice or locale negotiation. While not directly enabling code execution, hard-coded language behavior can cause misleading outputs, reduce operator comprehension, and increase the risk that users approve actions or results they do not fully understand.
The description is extremely broad and generic, stating the skill is suitable for general development scenarios and can be driven by natural-language instructions, without defining tight activation boundaries. In an agent environment with exec enabled, vague scope increases the chance the skill is invoked in unintended contexts or used to justify arbitrary command execution beyond news sentiment analysis.
