CNY RMB A股 China A shares Stock
Analysis
This skill appears aligned with its stated purpose of fetching public Weibo and A-share market data, with some user-noticeable dependency, credential-signal, and local-cache considerations.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
akshare (`pip3 install akshare`)
The skill depends on an external Python package without a pinned version. This is expected for the market-data purpose, but unpinned packages can change behavior over time.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Capability signals: - requires-sensitive-credentials; Requirements: Required env vars: none; Primary credential: none
The registry credential contract says no credentials are required, while the capability signals include a sensitive-credential requirement. The visible instructions also say public data sources do not need API keys, so this is a credential-contract ambiguity rather than evidence of actual credential use.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
自动保存每日数据到 `.cache/`
The skill discloses persistent local snapshot caching for historical comparisons. This is purpose-aligned, but it means retrieved market data can persist across runs.