goldskill

Provides real-time futures quotes, technical analysis, and news for gold, silver, crude oil, natural gas, and copper markets.

Security Scan

The skill's files, dependencies, and runtime instructions are consistent with providing commodity market quotes, technical analysis, and news; nothing obvious is requesting unrelated credentials or performing unexplained actions.

Purpose & Capability

Name and description (real-time quotes, technical indicators, news) match the included files (agent.py), the declared Python dependencies (yfinance, requests), and the SKILL.md triggers for commodity symbols.

Instruction Scope

SKILL.md only instructs standard installation (pip install -r requirements.txt), a health check (python3 agent.py --test), and sets trigger patterns. It does not ask the agent to read unrelated files or hidden system credentials. The code fetches RSS/news and market data as expected.

Install Mechanism

No special install spec in registry; SKILL.md uses a conventional pip3 install -r requirements.txt. Requirements list only yfinance and requests — standard PyPI packages for finance and HTTP access. This is normal for the stated purpose.

Credentials

The skill does not require environment variables or credentials. SKILL.md lists an optional OPENAI_API_KEY for non-core features; this is reasonable but optional. primaryEnv: python is a bookkeeping field, not a secret.

Persistence & Privilege

always is false and the skill is user-invocable. It does not request permanent elevated privileges or modify other skills' config. Autonomous invocation is allowed by default and not by itself a problem here.

Assessment

This skill appears coherent for fetching market quotes, indicators, and news. Before installing: (1) be aware pip will install packages into your environment—review requirements.txt and consider installing into a virtualenv; (2) the skill will make outbound HTTP requests to news and market-data endpoints (normal for this functionality); (3) do not supply your OPENAI_API_KEY unless you want the optional features that use it; (4) the skill's source/homepage is unknown—if you need higher assurance, review the full agent.py file locally (search for unexpected network endpoints, subprocess calls, or credential usage), run the provided health check, and consider running it in a sandboxed environment.

name: goldskill version: 1.0.0 description: 国际期货量化分析系统，支持黄金(XAUUSD)、白银(XAGUSD)、原油(CRUDEOIL)、天然气(NATGAS)、铜(COPPER)的实时行情、技术指标分析和相关新闻 primaryEnv: python install: command: pip3 install -r requirements.txt cwd: "${SKILL_DIR}" requires: env: - name: OPENAI_API_KEY required: false description: "OpenAI API Key（可选，不影响核心功能）" system:

• python3 healthCheck: command: python3 agent.py --test interval: 3600 triggers:
• pattern: "(黄金|金价|gold|XAU)" symbols: ["XAUUSD"]
• pattern: "(白银|银价|silver|XAG)" symbols: ["XAGUSD"]
• pattern: "(原油|油价|oil|WTI|Brent|OPEC)" symbols: ["CRUDEOIL"]
• pattern: "(天然气|气价|natgas|LNG)" symbols: ["NATGAS"]
• pattern: "(铜|铜价|copper)" symbols: ["COPPER"]
• pattern: "(大宗商品|期货|commodity)" symbols: ["XAUUSD", "XAGUSD", "CRUDEOIL", "NATGAS", "COPPER"]