Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed A-share investor meeting brief generator that uses public market data and does not include executable code, persistence, or hidden data handling.
This appears safe to install for A-share investor meeting preparation. Users should be aware that broad triggers may activate it for nearby finance research requests, and they should confirm before syncing any generated brief to Tencent Docs or sharing it with a team.
The trigger at line 14 is broad enough to match many ordinary finance workflows, which can cause this skill to activate when the user did not explicitly request it. In an investment-research context, unintended activation can lead to unnecessary retrieval, generation of sensitive meeting-prep content, and misrouting of user intent to a domain-specific skill.
The trigger on line 17 is too generic for the target domain and is likely to overlap with routine user requests that are not intended to invoke this specific skill. This increases the chance of accidental invocation, which is especially risky here because the skill performs structured financial profiling and meeting-preparation actions that may not fit the user's actual request.
The trigger on line 19 is ambiguous and commonly used in broader research or client-background discussions, so it may activate outside the intended scope of investor meeting preparation. In this skill's context, that creates a real prompt-routing weakness: users discussing general customer background could unintentionally invoke a workflow that aggregates company, holdings, and meeting-briefing content.
No suspicious patterns detected.
