Security audit
Security checks for vulnerabilities and agentic risk
This skill analyzes Chinese stock price data and creates support/resistance chart images, with some documentation inconsistencies but no evidence of hidden or harmful behavior.
Before installing, confirm you are comfortable with a Chinese-language stock-analysis skill that contacts Baostock or AkShare-backed data sources depending on which bundled script is run, and expect chart PNG files to be created locally, including on ~/Desktop for the documented Baostock entrypoint.
A mismatch between the declared data source and the actual one is a genuine supply-chain and transparency issue, even if it is not direct code execution. Users may approve or deploy the skill under assumptions about API stability, data handling, licensing, or network behavior that are false in practice.
A mismatch between the declared data source and the actual one is a genuine supply-chain and transparency issue, even if it is not direct code execution. Users may approve or deploy the skill under assumptions about API stability, data handling, licensing, or network behavior that are false in practice.
The skill name, description, headings, and usage instructions are entirely in Chinese, which effectively forces a specific language for users. The file does not offer an opt-in language choice or explain that the skill is intended only for a Chinese-speaking or region-specific audience.
The manifest description explicitly states '使用Baostock获取数据', which is part of the skill's declared behavior and implementation scope. In the code, the only market-data library imported and used is akshare, with data fetched through ak.stock_zh_index_daily and ak.stock_zh_a_hist_tx rather than any Baostock client.
The code writes a PNG directly to ~/Desktop without asking the caller for consent or allowing the output path to be controlled. While this is not code execution or data exfiltration, it is an unexpected side effect that modifies the local filesystem and may overwrite user expectations or fail in restricted environments.
The manifest description explicitly says the skill uses Baostock to obtain stock data, but the implementation imports akshare and later calls ak.stock_zh_index_daily and ak.stock_zh_a_hist. This is a direct mismatch between the advertised data source and the code's actual behavior.
L45-L47 的数据流程明确写着“akshare获取K线”，这与技能 manifest 中“使用Baostock获取数据（解决AKShare东财接口限制问题）”形成直接矛盾。这里不是单纯信息缺失，而是对同一核心实现细节给出了相反表述，属于文档意图与实现说明冲突。
This code saves a generated chart to the user-provided path when save_path is set, which is a file write operation. Although it logs after saving, there is no prior warning or confirmation about creating or potentially overwriting files, and the function docstring does not disclose that side effect.
The inline comment '保存到桌面' implies saving to the system desktop, but the implementation hardcodes os.path.expanduser('~/Desktop'). In many runtime environments this path may not correspond to the actual desktop or may not exist, so the comment overstates what the code guarantees.
The skill performs a local file write near the save operation without clearly warning the user at the point of action. In an agent-skill context, undisclosed filesystem side effects reduce transparency and can surprise users, especially when the skill description focuses on analysis and chart generation rather than persistent local writes.
The top-level docstring emphasizes '不用20日窗口法' as a distinguishing characteristic, yet peak/valley detection is implemented by comparing each candle against the previous and next N candles. While not literally a 20-day window, it is still a window-based local-extrema method, so the documentation overstates the methodological difference from windowed detection.
This code fetches market data from akshare-backed remote sources, which implies outbound network requests. Although there is a progress print, it does not disclose that the skill will contact external services or transmit the requested symbol/date parameters, and there is no surrounding warning comment or docstring about this behavior.
The visualize method saves charts to a user-specified path, and the test helpers invoke it with concrete filenames, causing local file creation. While there is a print after saving, there is no prior disclosure in the method description or entry-point flow warning users that running the script will create output files.
该技能文档标题及全文内容均为中文，没有说明是否仅面向中文用户，也未提供其他语言选项或用户选择机制。按规则，若技能在自然语言层面强制特定语言且无用户 opt-in，可能属于组织语言策略违规。
No suspicious patterns detected.
