依托东方财富数据库，面向沪深京港美五大市场的上市公司/股票，生成业绩点评类输出（含财报分析、业绩解读）。 当用户明确提出业绩点评、财报分析、业绩解读需求，或出现「业绩点评」「财报点评」「业绩分析」「季报/半年报/年报点评」「财务分析」「盈利分析」「业绩解读」等表述时，应触发本 Skill。 用户点名具体公司/股票...
Security Analysis
high confidenceThe skill's code, required environment variable, and runtime behavior are consistent with its stated purpose (calling EastMoney APIs to generate earnings reviews and saving returned attachments); nothing requests unrelated credentials or performs unexpected installs.
Name/description say it uses 东方财富 (EastMoney) data; the code calls EastMoney ai-saas endpoints (ENTITY_API, REPORT_LIST_API, PERFORMANCE_COMMENT_API) and requires a single EM_API_KEY for auth — this is appropriate and proportional to the stated purpose.
The SKILL.md and scripts clearly define entity recognition → report selection → call review API flow and instruct the agent to save attachments and optional JSON debug logs. That stays within the stated scope. Note: the scripts write returned attachments and logs to the local filesystem (default miaoxiang/stock-earnings-review/<run_id>/...). Also, save_attachment_payload does not sanitize filenames (it writes out Path(output_dir)/filename), so if the remote API ever returned a crafted filename with path traversal characters it could cause files to be written outside the intended directory; in the current codepaths the filenames used in call_review_api are fixed (e.g., 'review.pdf'), but the lack of filename sanitization is a minor implementation risk to be aware of.
This is instruction-only with a single declared Python dependency (httpx). No arbitrary downloads, package installs from untrusted URLs, or extract operations are present — low install risk.
Only EM_API_KEY is required (plus optional output-dir env vars) which matches the need to authenticate to EastMoney. No unrelated secrets or multiple credentials are requested.
always:false and no unusual persistence or cross-skill configuration changes. The skill writes per-run files into a project-scoped directory (configurable via env), which is expected for this functionality.
Guidance
This skill appears to do what it says: it calls EastMoney APIs using EM_API_KEY and saves returned attachments and optional debug logs under miaoxiang/stock-earnings-review by default. Before installing: 1) Verify the EM_API_KEY's issuer, scope, and expiry and prefer a key with least privilege. 2) Be aware that the skill will transmit the API key in request headers to ai-saas.eastmoney.com — do not supply keys that grant broader access (e.g., account management). 3) The skill writes files to the current working directory (or to a directory you set via STOCK_EARNINGS_REVIEW_OUTPUT_DIR); if you run the agent in a sensitive filesystem location, consider changing the output dir. 4) There's a minor implementation risk: filenames are not sanitized in the generic save routine, so avoid using this skill with untrusted/malicious API endpoints or altering code that allows external filenames. If you need higher assurance, ask the publisher for code signing, a vetted release, or run the scripts in an isolated environment.
Latest Release
v1.0.3
Publish 1.0.3
Popular Skills
Published by @financial-ai-analyst on ClawHub
