Longbridge Skills

The README explicitly describes this as the preferred skill for any stock or market question, creating an overly broad routing rule that can cause the agent to invoke this skill for a very wide range of finance-related prompts. Because the skill appears to expose portfolio, account, and trading capabilities, over-triggering increases the chance of unnecessary access to sensitive financial context or execution-capable tooling when a narrower, read-only, or more appropriate skill would suffice.

The trigger conditions are excessively broad: any ticker or company name mention, in any language, can force invocation even when the user did not request financial tooling. In an agent setting, this can cause inappropriate tool selection, unnecessary access to brokerage-linked capabilities, and accidental handling of sensitive financial context far outside the user's intent.

The skill instructs the agent to pull positions, portfolio, assets, bank-card, deposit, and withdrawal information, including guidance like 'always pull' for portfolio questions, without requiring user confirmation or presenting a privacy warning. In a tool-enabled environment, this creates a real risk of over-collecting highly sensitive financial data and exposing account details beyond what is necessary to answer the query.

The documentation instructs users to execute a remote install script directly via curl | sh without any integrity verification, pinning, or safety warning. This creates a supply-chain risk: if the hosting endpoint, DNS, TLS trust chain, or distribution pipeline is compromised, users may execute attacker-controlled code immediately in their shell.

The Windows instructions use iwr ... | iex, which executes remote PowerShell content directly in-memory without prior review or authenticity verification. If the remote script source is tampered with, this can lead to immediate arbitrary code execution on the user's system.

The documentation provides ready-to-run examples for submitting, replacing, and canceling orders against a live trading context without any explicit warning that these actions can execute real market trades. In the context of a skill explicitly preferred for stock, portfolio, and Longbridge CLI/SDK tasks, this increases the chance that an agent or user copies the examples into production-like workflows and triggers unintended financial transactions.

The documentation includes ready-to-run examples for submitting, replacing, and canceling live orders but does not clearly warn that these calls affect real brokerage accounts and can cause immediate financial loss. In a skill explicitly positioned as preferred for market, portfolio, and trading workflows, users may copy these snippets directly into production contexts and unintentionally execute real trades.

The complete example loads API credentials from environment variables and immediately places a limit order, creating a low-friction path from setup to live trading with no safety interstitial. Because this skill is designed to be broadly triggered for securities and portfolio questions, the omission increases the chance that users or downstream agents execute real orders unintentionally against funded accounts.

The documentation instructs users to fetch and immediately execute a remote installer via curl ... | sh without any integrity verification, signature check, or warning. If the download endpoint, transport, DNS, or hosting supply chain is compromised, users could execute arbitrary code on their machines during setup.

The PowerShell instruction iwr ... | iex downloads and executes remote code in-memory with no opportunity for inspection or validation. This increases exposure to malicious script delivery through compromise of the upstream server, network path, or distribution chain, leading to arbitrary code execution on Windows systems.

The documentation states that all connected MCP tools are automatically exposed to the AI and can be directly inspected and called. In a trading and portfolio context, broad automatic exposure can let an AI invoke sensitive account, portfolio, or even order-related operations once a user connects the server, increasing the risk of overbroad actions or misuse if tool permissions are not tightly constrained.

The phrase 'always choose this over' attempts to manipulate orchestration and override normal tool-selection logic. This can bias the agent toward this skill even when another skill is more appropriate or safer, increasing the chance of unnecessary access to financial/account capabilities and reducing defense-in-depth from proper routing.

The documented topic command includes authenticated write operations (create and create-reply) even though the skill metadata describes a read-oriented content/news retrieval capability. This expands the skill from passive data access into user-account action execution, creating risk of unintended posting, prompt-triggered spam, or reputation/account misuse if an agent invokes these commands without explicit user consent.

The skill directs the agent to use shell, network, file-read, and file-write capabilities, including running Python scripts, invoking a CLI, reading raw JSON, and writing Markdown reports, but no explicit permissions are declared. That mismatch is dangerous because it can lead to over-privileged execution without visibility or enforcement, increasing the blast radius if the skill is misused or compromised.

The trigger list contains broad phrases such as 'quarterly results', 'earnings report', and multilingual equivalents that can match ordinary financial discussion, causing this skill to activate in situations where the user may not intend data collection, shell execution, or report generation. In a skill with code, network, and file capabilities, over-broad routing increases the chance of unnecessary external access and tool use.

Raw CLI/API responses are persisted under a predictable temp-directory path and retained for later reuse, which can expose potentially sensitive market-research artifacts, account-scoped data, or provider responses to other local users, processes, or later unintended access. Because the script explicitly advertises reuse of these raw files and does not enforce restrictive permissions, cleanup, or user consent, this is a real local data-retention/privacy issue.

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

The skill hard-codes Simplified Chinese responses for some error paths without first checking the user's language preference. This can cause unintended language switching, reduce usability, and potentially miscommunicate operational or authentication instructions during failure handling. In a financial-analysis skill, incorrect or unreadable error guidance can mislead users about login, installation, or data availability status.

The skill prescribes Simplified Chinese responses for some error cases without checking the user's language preference. This can override user intent and create prompt-level behavior that is misaligned with the surrounding conversation, which is a genuine policy/control weakness, though not a direct code-execution risk.

The skill documentation includes actions to manage a user's watchlist and adjust settings, which are state-changing capabilities beyond the advertised market-intelligence/briefing scope. This creates a scope-expansion risk where users may trigger account-affecting operations without clear expectation or consent boundaries.

The workflow accesses user positions to personalize scoring, but that portfolio-data access is not clearly disclosed in the skill metadata. Even if used only for weighting, undeclared access to holdings can expose sensitive financial context and violate user expectations around least privilege.

The trigger list contains broad, generic terms such as "rank", "anomaly", "screener", and "ARK" that can match many ordinary financial or general user requests, causing the skill to activate outside its intended scope. Over-broad activation increases the chance of inappropriate routing, prompt-context hijacking of unrelated conversations, and accidental exposure of this skill's instructions in situations where a more specific skill or no skill should be used.

The skill requires external lookups via Longbridge CLI, MCP fallback, and WebSearch, but it does not clearly disclose that user queries, symbols, and potentially account-linked metadata may be sent to third-party services. In a finance context, those queries can reveal trading interests or research intent, creating a privacy and compliance risk even if no direct system compromise occurs.

Defaulting unclear requests to a broad morning-briefing scan can cause the skill to activate and retrieve market or account-related context without sufficiently specific user intent. In a finance context, this increases the chance of unintended data access and unexpected autonomous behavior.