Security audit
Security checks for vulnerabilities and agentic risk
This looks like a financial data CLI skill, but it installs a remote executable and makes persistent PATH changes that users should review first.
Install only if you trust the stockbuddy.qq.com/Tencent source for the westock binary and are comfortable with a local executable being placed in your user bin directory. Review the setup script first, prefer dry-run or a custom install directory if available, and be aware the bash and PowerShell installers can persist PATH changes. Treat the returned market data as informational, not investment advice.
bash scripts/setup.sh
bash scripts/setup.sh
bash scripts/setup.sh
7. **探索纪律**——`SKILL.md`/`commands.md` 已覆盖的命令勿再 `--help`（每任务至多 1 次），优先查本文速查表而非反复试探。
tmpc="$(mktemp)"
if ! download_file "$BASE/$VERSION/SHA256.txt" "$tmpc"; then
if has_pinned; then
err "无法下载 SHA256.txt，且已配置固定校验值，拒绝安装"; rm -f "$tmpc"; exit 1
fi
warn "未找到 SHA256.txt，跳过校验"; rm -f "$tmpc"; return 0
fitmpc="$(mktemp)"
if ! download_file "$BASE/$VERSION/SHA256.txt" "$tmpc"; then
if has_pinned; then
err "无法下载 SHA256.txt，且已配置固定校验值，拒绝安装"; rm -f "$tmpc"; exit 1
fi
warn "未找到 SHA256.txt，跳过校验"; rm -f "$tmpc"; return 0
fimanifest_actual="$(sha256_of "$checksum_file")"
if [[ -z "$manifest_actual" ]]; then
err "无 shasum/sha256sum 工具，无法校验清单完整性，拒绝安装"
[[ "$IS_REMOTE" -eq 1 ]] && rm -f "$checksum_file"
exit 1
fi
if [[ "$(printf '%s' "$manifest_actual" | tr 'A-Z' 'a-z')" != "$(printf '%s' "$PINNED_MANIFEST_SHA256" | tr 'A-Z' 'a-z')" ]]; thenmanifest_actual="$(sha256_of "$checksum_file")"
if [[ -z "$manifest_actual" ]]; then
err "无 shasum/sha256sum 工具，无法校验清单完整性，拒绝安装"
[[ "$IS_REMOTE" -eq 1 ]] && rm -f "$checksum_file"
exit 1
fi
if [[ "$(printf '%s' "$manifest_actual" | tr 'A-Z' 'a-z')" != "$(printf '%s' "$PINNED_MANIFEST_SHA256" | tr 'A-Z' 'a-z')" ]]; thenmanifest_actual="$(sha256_of "$checksum_file")"
if [[ -z "$manifest_actual" ]]; then
err "无 shasum/sha256sum 工具，无法校验清单完整性，拒绝安装"
[[ "$IS_REMOTE" -eq 1 ]] && rm -f "$checksum_file"
exit 1
fi
if [[ "$(printf '%s' "$manifest_actual" | tr 'A-Z' 'a-z')" != "$(printf '%s' "$PINNED_MANIFEST_SHA256" | tr 'A-Z' 'a-z')" ]]; then# ---- 下载工具（定义提前，供版本解析与二进制下载共用） ----
download_file() {
local url="$1" out="$2"
if command -v curl >/dev/null 2>&1; then
curl -fsSL "$url" -o "$out"
elif command -v wget >/dev/null 2>&1; then
wget -qO "$out" "$url"No suspicious patterns detected.