a-share-dragon-tiger-report@4.0.5
CAUTION· static onlyPublisher claims: "生成 A 股「涨停板龙虎榜深度研判报告」提示词 v4.0「宏观锚定 · 五维共振 · 水印隔离 · GCCEO 全量整合 · 投行级量化研判」 （2026-11-12 定稿）。口径 v2.3 六条永久冻结 + KNOWLEDGE 45 键；三层只读旁路叠加： v3.0 五维共振（L0宏观16条只下调 / 策略因子13条 / X-主题17方向三层白名单 / 短线金手24条 / 三类水印，自检14/14） ＋ v3.1 GCCEO 4.0 全量整合（十域91技能 / 投行A1-A10 / 出海G1-G10 / AI超能力8 / 方法论16 / 五步决策框架，自检23/23） ＋ v4.0 投行级量化研判（真值算+缺口标注：估值锚/利润质量/五维形态/Pre-Mortem/缺口台账/全链路，自检25/25）。 GCCEO 以「研判视角映射」接入：只输出标签/清单/风险提问/叙事脚手架，无剔除权、无打分权、无仓位上调权； v4.0 量化层真值算、缺口如实标注，**绝不编造 DCF/LBO/ROE/净现比**，不生成 BUY。 四层漏斗 L1→L2→L2.5→L3（半年口径 + 增速红线 + 利润质量红旗≥2 强否决）一字不改； 情绪五阶段仓位 30/60/70/20/0% 不变。 BII 双栏默认 20 页（前14页 v2.3 逐字不改 + 第15/16页 v3 附录 + 第17/18页 GCCEO 附录 + 第19/20页 v4.0 投行量化附录）； 四态回滚：gceo_quant.enabled=false→18页、gceo.enabled=false→16页、v3.enabled=false→14页（单向强依赖 gceo_quant⊂gceo⊂v3）。 输出 HTML / PDF；样式 A（classic，含 PPTX）仅在明确要求时补出。 内置「十五五 18 方向（102板块+12SW1+70股）」与 Anthropic S-1 → A股 AI 链映射； 蒸馏语料 31 份 + 4 本经典 + 5 份宏观/趋势研报；GCCEO 源 10 域 91 技能。仅交易日生成，非交易日直接说明休市并结束。 v3.1.1 编排层：固化「当日主研判 / 次日预判核验 / 投资大师圆桌」三条流水线的触发前提、 数据契约、产物路径与权限边界（第十八章）。 v3.1.2 资金规模层：按本金规模自适应换结构（小本金 / 机构级 ≥1亿），金额三档单位、 图表刻度、第 10 页由「α 预算纪律」重构为「资金容量与执行约束」（真实 20 日均成交额实算容量表）； 判定内核与冻结口径零改动，自检与页数不变。 v3.2 选股源主口径：selection_mode=limitup 时从当日涨停梯队 + 龙虎榜净买 + 主线资金找， 超跌池降级为位置对照；旧漏斗与冻结阈值一字不改，oversold 可完整回滚。 v3.2.1 涨停源深化：validate() 数据契约六项校验 / verify_covered() 真跑 L2.5·L3 冻结闸门 / capacity_check() 联动 §18.7 资金容量层；第 13 页整表改涨停源观察榜（动作恒 WATCH）， 第 4 页声明 TOP8 截断与闸门实跑，第 13 页说明条登记契约与容量结论；自检 11/11。 v4.0.3 跨会话长期实盘口径：本金 ¥100,000（取代旧 7,000 元），周目标 ¥15,000、 单笔最大亏损 ¥5,000；比例纪律与两套闸门不变，7 亿机构容量口径独立不串味（§18.11）。 v4.0.4 统一深度投研报告流水线：四阶段 A/B/C/D 合并为「一次触发 · 一份主交付」， 2026-11-13 实跑基线（64 内联 SVG / 31 表 / 57 页 A4）、三链 5/20 日净额口径修正 与三重校验清单见 §18.12 及 docs/unified-deep-research-pipeline-20261113.md。 v4.0.5 安全加固：新增 §18.13 工具权限边界与安全声明（行情只读 / 本地文件只写自身产物 / 无凭证访问 / 无自动远端发布）；安装脚本移除 `rsync --delete` 改为备份后逐文件覆盖； 示例 JSON 与样本报告明确标注为 2026-11-13 快照，禁止沿用为当期真值。 **不构成投资建议**。" Observed in sandbox: static analysis only — behavior not yet observed.
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-14 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyThis version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
[ -n "${CHROME_PID:-}" ] && kill "$CHROME_PID" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.### 7.4 data.json.gceo 顶层覆盖层结构（build_gceo_inputs.py 装配）Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.p = subprocess.run(["node", "--check", tmp], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.### 7.3 data.json.v3 顶层覆盖层结构（build_v3_inputs.py 装配）Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.…不编造数字；GCCEO 技能数 96/91 双口径只取 91 结构口径，不写阈值。 --- ## 十四、输出与验收技术规格 1. **输入**：`data.json`（第七章，v2.3 字段 + 顶层 v3 + 顶层 gceo）、`predictions.json`（5 条）、`framework/*.json`（l1_industry / l2_stock / l25_untradable / l3_financials / 15th5_directions / 15th…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.[ -n "${CHROME_PID:-}" ] && kill "$CHROME_PID" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.res = subprocess.run(cmd, cwd=str(TEMPLATES), env=env, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.…深度研判报告 | 收盘双关校验 → `data_lhb(date=报告日)` 全市场榜实取 → 拆涨停主池 / 背离池、落 `raw/lhb_limitup_*.json` 与 `data.json.limitup` → `selection_mode="limitup"` → `python3 strategy/limitup_source.py`（`validate()` 不通过即中止；`verify_covered()` 真跑 L2.5/L3；`capacity_ch…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.res = subprocess.run(cmd, cwd=str(REPO))Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.res = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim yjkj999999: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.