A 股全流程量化决策系统

This skill appears to be what it claims (an automated A‑share analyst) but it asks you to provide or store sensitive items that are not declared in the registry metadata. Before installing: - Treat Datasaver dev_id/api-key and Eastmoney browser Cookie as sensitive. Do not paste them into shared environments or public chat. If you must use them, store them in a secure local config and rotate them regularly. - The skill instructs adding a .mcp.json entry pointing at https://datasaver.deepminingai.com — verify you trust that service before putting secrets there. - If you do not want the agent to run autonomously on a schedule, do not register the cron tasks (or review their payloads first). Scheduled tasks will cause the agent to read your MEMORY.md and other workspace files on each run. - Because the manifest did not declare required config paths/credentials, assume the skill expects you to create/modify files in your workspace; restrict this to an isolated project/workspace if possible. - Prefer running optional components (Datasaver, InStock Docker) in controlled, local environments. If you prefer more privacy, skip Datasaver and rely on the core curl/push2 endpoints (the SKILL claims core features still work without these optional tokens). If you want me to: I can extract the exact lines that reference credentials and config paths, or produce a checklist to safely provision this skill (what to store where and what not to paste in public).