BC moneybigA
moneybigA — A股/港股/美股机构级多框架股票分析 Skill。 专为主动交易者和研究者设计：筹码分布+主力控盘、智能资金概念(SMC)订单块/公允价值缺口/流动性清扫、 威科夫吸筹/派发六阶段、波浪理论浪级判断、MACD背离、量价关系； 基本面层：杜邦三因子、DCF内在价值、PEG/EV-EBITDA估值、波特五力行业竞争； 量化层：Alpha101多因子评分体系（动量/价值/成长/质量/资金流）。 自动搜集实时数据，输出带综合评分仪表盘的交互式 HTML 报告， 含分级买卖信号（HIGH/MEDIUM/LOW 置信度）、风险等级触发条件、止损参考与目标价。 Trigger on：股票分析、筹码分布、买卖信号、主力控盘、短线机会、上证指数、基本面分析、 财务分析、估值分析、财报综合分析、行业分析、技术分析、量化选股、波浪理论、威科夫、 SMC、Order Block、Alpha因子、stock analysis、chip distribution、buy signal、 sell signal、fundamental analysis、valuation、DCF、financial report analysis。
As a process C 52/100 · Has gaps — weak spots: result and completion, inputs and preconditions, failures and branches
What is at stake
The skill contains fragments that, in the wrong hands, cost money or data. Below: what the installer risks and what the author should do.
The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".
If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.
How to improve
- Address the high-severity findings: each costs 18 safety points. If one is a false positive, add the rule id to guard.allow in spec.yaml.
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 1
-
high Exfiltration
intent-browser-credential-storeskill-card.md:33Accesses a browser credential / cookie store**Other Properties Related to Output:** [Uses public web data where available; does not request credentials, place trades, persist user data, or write local files according to the artifact documentati
Files scanned: 5. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
- warning
name-formatname should be kebab-case (lowercase letters, digits, hyphens) - note
frontmatter-keyunknown frontmatter key "keywords"
Process rating: all ten parameters 52/100
- 0Result and completion. Does not say what the result is
- 0Inputs and preconditions. Does not say what the process needs to start
- 0Failures and branches. Linear process with no failure handling
- 0Progress reporting. Says nothing while it works
- 60Tools and files. Uses tools (bash, web) that frontmatter does not declare
- 70When it triggers. States when to use, but not when not to
- 100Steps. 29 steps
- 100Consistency. Name and required fields are in place
- 100Execution cost. Instruction body is 709 tokens
- 100Running it twice. No mutating operations
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +5Description has no quoted example phrases that should trigger the skill
- +4Description does not say when NOT to use the skill (false activations)
- +3Output format is not stated: the model decides each time
- +1No license
- +2Single-language instructions
- +3Description length 521: enough signal without eating the budget
- +4Structure: 17 headings
- +3Step-by-step instructions: 29 items
- +4Has examples (5 code blocks)
Quality base 70; lint remarks subtract, signals add up to 100. Result: 78.