uzi
wbh604/UZI-SkillSkill
A-share, Hong Kong, and US stock analysis skill for deep research, quick scans, investor panel review, hot-money/LHB analysis, trap detection, valuation, IC memos, and Bloomberg-style HTML reports.
Why this score
This repo hosts 5 skills, so its 7,287 stars are split between them (about 1,457 each) for scoring.
Popularity score: 82/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Oct 20, 2026 at commit 3dc556bdad82, first 300 source files (it's a large repo), with Cisco's open-source skill-scanner.
What its code does:
- Reads environment variables and sends network requests with them API clients do this to send your key to the service. Check which service it talks to.run.py, skills/deep-analysis/run.py and 2 more
- Runs shell commands Common for dev tools. Read the commands it runs.INSTALL-HERMES.md:1, README.md:1, RELEASE-NOTES.md:1 and 3 more
- Runs code it builds while running (eval or exec) Harder to read ahead of time, since the code is assembled while it runs.run.py, skills/deep-analysis/run.py
- Makes network requestsSKILL.md, skills/deep-analysis/scripts/fetch_contests.py:140, skills/deep-analysis/scripts/fetch_events.py:64 and 28 more
- Installs system packagesinstall-hermes.sh:51 and 1 more
Web addresses in its code:
- xueqiu.comAGENTS.md:341
- fund.eastmoney.comskills/deep-analysis/scripts/fetch_fund_holders.py:20
- pypi.tuna.tsinghua.edu.cnAGENTS.md:336
- taoguba.com.cnskills/deep-analysis/scripts/fetch_contests.py:137
- qt.gtimg.cnskills/deep-analysis/scripts/lib/daily_screen/sources.py:136
- cninfo.com.cnskills/deep-analysis/scripts/fetch_events.py:40
- query1.finance.yahoo.comskills/deep-analysis/scripts/lib/data_source_registry.py:231
- cfachina.orgskills/deep-analysis/scripts/fetch_policy.py:21
- data.eastmoney.comskills/deep-analysis/scripts/lib/data_integrity.py:198
- developers.cloudflare.comrun.py:231
- mirrors.aliyun.comrun.py:151
- push2.eastmoney.comAGENTS.md:338
- pypi.mirrors.ustc.edu.cnrun.py:152
- quote.eastmoney.comAGENTS.md:340
- www1.hkexnews.hkskills/deep-analysis/scripts/lib/data_source_registry.py:110
And 91 more.
These are the sites named in the code, so it's where your data could go. It isn't a complete list: code can build addresses while it runs, and a few of these may be links rather than calls. Whatever you send also goes to the AI model you use.
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Alternatives
Nothing from another maker does quite the same job yet.