Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese-language industry research assistant with an optional public market-data helper, and I found no hidden persistence, credential access, or destructive behavior.
Install only if you want a Chinese-oriented industry research workflow that may use web searches and public market data. Treat its investment ratings, stock comparisons, and suggested positions as research assistance, not financial advice, and verify cited sources before acting on them.
声明描述的是一个高层次、结构化的行业研究技能，核心输出应是完整行业研究报告。实际代码并未实现这些分析能力，而是一个狭义的数据辅助工具，主要访问Yahoo Finance抓取个股市场数据，并将其格式化为Markdown表格。对于行业参数，脚本反而明确提示“仅获取股票行情数据”，并建议用户自行搜索市场规模和行业报告。这说明其真实主功能与声明存在显著偏差：从“深度行业研究生成”降级为“股票数据采集/比较辅助”。虽然公司对比可被视为行业研究的一个支持环节，但代码缺失声明中的大部分关键分析能力，因此构成明显不匹配。
The skill explicitly instructs the agent to perform web/data searches and use recent news, but it declares no tool scope or allowed-tools policy. That mismatch can lead to unintended network access or broader-than-expected tool use, reducing sandboxing and reviewability.
The trigger phrases are very broad and overlap with ordinary research-related language, making accidental or silent activation more likely. If auto-invoked, the skill could initiate unnecessary searching, produce investment-oriented outputs, or steer conversations into a specialized mode the user did not explicitly request.
The natural-language instructions are written entirely in Chinese and repeatedly frame analysis around Chinese market data and output patterns, but do not state that this is optional or user-selectable. Under the policy, a skill should not implicitly force a specific language or locale unless it clearly offers opt-in or documents a justified regional restriction.
This markdown file presents the skill's output examples exclusively in Chinese, which can amount to a language/locale policy violation when no user opt-in or alternative language option is provided. The instructions specify flagging cases where a skill forces a specific language without user choice, and no such choice or justification appears in the file.
The file title and introductory instructions are entirely in Chinese, and the document presents itself as a general execution framework rather than a clearly region-locked or language-specific tool. Under the policy, imposing a specific language without user opt-in is a natural-language locale violation.
The file's docstring, argument descriptions, and runtime guidance are written entirely in Chinese, which imposes a specific language on users. The skill does not offer an English alternative, language selection, or explain that it is intentionally limited to a Chinese-speaking or region-specific audience.
