Security audit
Security checks for vulnerabilities and agentic risk
This looks like a financial data CLI skill, but it installs a remote executable and makes persistent PATH changes that users should review first.
Install only if you trust the stockbuddy.qq.com/Tencent source for the westock binary and are comfortable with a local executable being placed in your user bin directory. Review the setup script first, prefer dry-run or a custom install directory if available, and be aware the bash and PowerShell installers can persist PATH changes. Treat the returned market data as informational, not investment advice.
The declared purpose is financial data querying, but the skill behavior includes downloading/installing a remote binary, executing setup scripts, and modifying shell profiles. That mismatch is dangerous because users and higher-level policy may trust the skill as a read-only data tool, while it actually performs software installation and persistent local system changes.
Referenced artifact was not completely inspected
bash scripts/setup.sh
Referenced artifact was not completely inspected
bash scripts/setup.sh
Referenced artifact was not completely inspected
bash scripts/setup.sh
Referenced artifact was not completely inspected
7. **探索纪律**——`SKILL.md`/`commands.md` 已覆盖的命令勿再 `--help`（每任务至多 1 次），优先查本文速查表而非反复试探。
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
tmpc="$(mktemp)"
if ! download_file "$BASE/$VERSION/SHA256.txt" "$tmpc"; then
if has_pinned; then
err "无法下载 SHA256.txt，且已配置固定校验值，拒绝安装"; rm -f "$tmpc"; exit 1
fi
warn "未找到 SHA256.txt，跳过校验"; rm -f "$tmpc"; return 0
fi
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
tmpc="$(mktemp)"
if ! download_file "$BASE/$VERSION/SHA256.txt" "$tmpc"; then
if has_pinned; then
err "无法下载 SHA256.txt，且已配置固定校验值，拒绝安装"; rm -f "$tmpc"; exit 1
fi
warn "未找到 SHA256.txt，跳过校验"; rm -f "$tmpc"; return 0
fi
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
manifest_actual="$(sha256_of "$checksum_file")"
if [[ -z "$manifest_actual" ]]; then
err "无 shasum/sha256sum 工具，无法校验清单完整性，拒绝安装"
[[ "$IS_REMOTE" -eq 1 ]] && rm -f "$checksum_file"
exit 1
fi
if [[ "$(printf '%s' "$manifest_actual" | tr 'A-Z' 'a-z')" != "$(printf '%s' "$PINNED_MANIFEST_SHA256" | tr 'A-Z' 'a-z')" ]]; then
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
manifest_actual="$(sha256_of "$checksum_file")"
if [[ -z "$manifest_actual" ]]; then
err "无 shasum/sha256sum 工具，无法校验清单完整性，拒绝安装"
[[ "$IS_REMOTE" -eq 1 ]] && rm -f "$checksum_file"
exit 1
fi
if [[ "$(printf '%s' "$manifest_actual" | tr 'A-Z' 'a-z')" != "$(printf '%s' "$PINNED_MANIFEST_SHA256" | tr 'A-Z' 'a-z')" ]]; then
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
manifest_actual="$(sha256_of "$checksum_file")"
if [[ -z "$manifest_actual" ]]; then
err "无 shasum/sha256sum 工具，无法校验清单完整性，拒绝安装"
[[ "$IS_REMOTE" -eq 1 ]] && rm -f "$checksum_file"
exit 1
fi
if [[ "$(printf '%s' "$manifest_actual" | tr 'A-Z' 'a-z')" != "$(printf '%s' "$PINNED_MANIFEST_SHA256" | tr 'A-Z' 'a-z')" ]]; then
The skill exposes shell, network, and environment capabilities without declaring any explicit tool scope or permission boundaries. In this context, the skill instructs the agent to run installer scripts and a networked CLI, so the absence of an allowlist makes it easier for the skill to trigger broad system actions beyond simple data retrieval.
The title and the entire guide are written as a mandatory Chinese reference guide, and no section offers an alternative language or user opt-in for locale/language preferences. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
在风险事件章节中，多个子类明确给出了 riskLevel 及其判定标准，例如股权质押、诉讼仲裁等，表示系统确实提供了风险分级逻辑。L784 又写明“只提供客观数据展示，不进行主观评分或风险等级判定”，这与前述内容直接矛盾，属于文档意图与实际说明不一致。
The title and the document content are presented in Chinese only, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
该文件全文以中文编写并以中文标题开头，面向技能使用说明时未见提供语言选项、双语说明或明确声明仅适用于中文用户/场景。根据规则，若技能强制特定语言而无用户选择或合理限定，属于自然语言层面的语言/locale 策略问题。
This markdown file is written entirely in Chinese and all example user interactions, instructions, and outputs assume Chinese-language use. There is no indication that the skill supports user language choice or that the Chinese-only constraint is a documented, justified regional requirement, which matches the language/locale policy violation criteria.
The file's comments, help text, prompts, and error messages are all written in Chinese, including user-facing strings such as usage instructions and confirmation prompts. This imposes a specific language/locale on all users with no opt-in, fallback, or documented region-specific justification, which matches the policy's language/locale violation criteria.
The manifest describes a read/query-oriented financial market data skill, but this setup script persists changes to the user's environment by editing the User PATH. Altering shell environment configuration is an installation/system-management capability, not something justified by the stated end-user purpose of structured market data querying.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# ---- 下载工具（定义提前，供版本解析与二进制下载共用） ----
download_file() {
local url="$1" out="$2"
if command -v curl >/dev/null 2>&1; then
curl -fsSL "$url" -o "$out"
elif command -v wget >/dev/null 2>&1; then
wget -qO "$out" "$url"
The installer appends an export line to the user's shell profile without any explicit up-front warning or opt-in. Modifying startup files is persistent behavior that can surprise users, affect future shells, and in a skill/install context creates unnecessary trust and persistence risk even if the added line itself is not overtly malicious.
L448-L457 的 type 表中，其他 type 值均为简短标识符，但 L453 将完整命令名 westock technical 放在 type 列，且 L463 示例使用的是 --type technical,updown。这说明文档中的 type 值描述与实际命令用法相互矛盾，可能误导调用方。
The surrounding examples and parameter documentation state that --event accepts identifiers like dividend and ipo, but the event-options table lists westock dividend and westock ipo in that position. This actively contradicts the documented command syntax for westock calendar and could mislead an agent into invoking the wrong command or passing invalid values.
该 markdown 文件整体以中文编写，并在 schema 说明中明确指标名为中文，如 IndicatorName 一项写明“指标名（中文，如...）”。按照语言/locale 政策，若技能默认强制单一语言而未给用户提供选择或明确说明其为特定受众文档，可能构成自然语言层面的语言策略问题。