Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed market-analysis skill with financial-advice and language-scope caveats, but no evidence of hidden execution, persistence, exfiltration, or account-changing behavior.
Install only if you want Chinese-language stock and macro market commentary and can provide a stock-data API key. Treat any scores, sector rankings, and buy/sell/position suggestions as general information, not personalized investment advice. Also note that several referenced helper scripts and the report template are missing from the package, so parts of the workflow may not run as written.
The trigger phrases are broad, generic market-analysis requests that overlap with ordinary financial conversation, so the skill may activate when the user did not explicitly intend to invoke it. In a finance context, unintended invocation is meaningful because it can cause the agent to produce analysis that users may rely on as investment guidance without clear consent or proper framing.
Although the skill requires a disclaimer, it does not clearly warn that the output is not personalized investment advice and may be acted on by users as such. Because the skill generates weighted scores, market states, and action recommendations, the presentation materially increases the chance that users interpret it as actionable financial advice.
The module title and description are written entirely in Chinese, and all user-facing recommendation strings throughout the skill are also hard-coded in Chinese. This creates a language/locale constraint without any visible opt-in or documented justification, which matches the policy category for forced language use.
整份技能说明、触发短语和输出要求均默认使用中文语境，且面向“A股/美股/港股”分析时没有说明是否允许按用户偏好切换语言。对于覆盖多市场的技能，若默认强制单一语言而无选择机制，可能不符合语言/locale 选择政策。
No suspicious patterns detected.
