broker-research-analyst
券商研报分析助手，聚焦"研报获取→结构化提取→多机构观点对比→风险识别→决策辅助"。使用时机：汇总个股券商研报、追踪行业研报、对比多机构观点、识别卖方利益冲突、验证研报时效性。默认数据源为东方财富研报中心公开接口（无需 API Key）。
67
82%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Security
1 critical severity finding. Installing this skill is not recommended: please review these findings carefully if you do intend to do so.
E006: Malicious code pattern detected in skill scripts.
What this means
Detected high-risk code patterns in the skill content — including its prompts, tool definitions, and resources — such as data exfiltration, backdoors, remote code execution, credential theft, system compromise, supply chain attacks, and obfuscation techniques.
Why it was flagged
The code executes JavaScript obtained from remote challenge pages via an unsandboxed eval (running it in a local node subprocess) to bypass anti-bot protections, which enables remote code execution and effectively creates a high-risk backdoor/execution vector.
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL 的运行链路在 `scripts/report_router.py` 下载并解析“东方财富公开 PDF”（外部来源），再把解析到的研报正文“可读文本摘录/段落”（由 `scripts/pdf_parser.py` 提取 `parsed.excerpt(...)`）注入到最终 Markdown 中，进而进入（TRAE/Claude Code 编排的）LLM 上下文：`generate_report.py` 将其嵌入 `llm_analysis['pdf_excerpts']` 代码块内容（可被 LLM 读取）。
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill fetches PDFs from https://pdf.dfcfw.com/pdf/H3_{infoCode}_1.pdf at runtime and, when encountering anti-bot challenge pages from that domain, extracts and executes the remote <script> JavaScript via a local node subprocess to compute cookies (scripts/pdf_downloader.py), which is executing remote code fetched at runtime.
- Repository
- charliedream1/ai_quant_trade
- Commit
3dba332
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.