Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed stock-analysis guidance skill that uses public market data and user-provided holdings, with no bundled code, persistence, credential collection, or trading authority.
Before installing, understand that this skill may generate stock recommendations, target prices, stop-loss levels, and portfolio diagnostics from public market data and information you provide. Use it as informational analysis only, verify data freshness and accuracy, and avoid sharing more portfolio detail than needed.
The manifest description, trigger phrases, and usage instructions are entirely written around Chinese-language invocation, and the file does not state that language selection is optional or that the skill is intentionally limited to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The trigger phrases are broad, generic financial-assistance requests such as '推荐股票', '买什么好', and '大盘怎么样', which can easily match normal conversation and cause the skill to activate when the user did not explicitly request this specific tool. In a finance skill, unintended activation is more dangerous because it may lead to unsolicited investment analysis or recommendations based on external market data, creating trust, compliance, and user-intent risks.
No suspicious patterns detected.
