trading-quant

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). EastMoneyNewsFetcher在运行时通过GET到东方财富新闻接口（含kuaixun/个股搜索）将新闻标题/摘要文本解析后传入情感分析逻辑（sentiment.py 的 analyze/analyze_batch 读取可执行的文本输入），形成对“新闻原文”的外部文本摄取路径。

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I scanned the repository for literal high-entropy tokens and found two kinds of hardcoded, non-placeholder values that look like real API/client identifiers:

1. The EastMoney "ut" parameter value "b2884a393a59ad64002292a3e90d46a5" (appears multiple times). This is a 32-character hex-like token embedded directly in API request params — high entropy and likely a client token used with EastMoney endpoints.

2. The Jin10 header "x-app-id" value "bVBF4FyRTn5NJF5n" (in multi_news). This is a short opaque app id included in request headers and looks like a real application identifier.

I flagged these because they are literal, non-placeholder strings that resemble usable API identifiers/keys. I did not flag any obvious placeholders (YOUR_API_KEY, sk-xxxx, etc.), passwords, or example values elsewhere in the docs/code.