china-stock-data

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes examples that embed API tokens/passwords directly in code and curl commands (including a real-looking jqdatasdk auth call), which requires the LLM to emit secrets verbatim and thus poses an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.78). 该技能的运行流程会从外部网页/第三方数据源抓取公告与新闻等“自由文本”（如 CNINFO 公告详情页 HTML/PDF 文本、同花顺快讯 digest/title），并在日报工作流中把这些内容拼进 GPT-Image-2 的 prompt（从而进入 LLM 上下文）；因此存在间接提示注入风险。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the documentation for literal, usable credentials.

Flagged:

• The long Tushare token "be048ffb8d6a29f64139a9da1f88fbd31783ccf4cc10582ce58ad5e1" is a high-entropy API token (not a placeholder) → real secret.
• The JoinQuant/JQData account credentials (phone 13986187760 with password Yu123(j)) appear in multiple auth() calls and account records. Although the password is not extremely long, it is a real credential used directly in auth() and therefore actionable — I treat it as a secret.

Ignored (not flagged):

• "YOUR_TOKEN", "your_token", "your_service_role_key", or similar placeholders — documentation placeholders per rules.
• Example placeholders in config snippets, environment variable names (e.g., WENCAI_TOKEN), or redacted/truncated values — these are not literal secrets.
• Simple setup passwords used as illustrative examples are treated as non-secrets; none of the simple examples here matched the high-entropy/API-key criteria except the JQData password which is used practically in auth().