A-Stock Kline Analyzer

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a coherent stock K-line analysis tool, with disclosed finance-data API use and user-directed Python dependency installation.

This skill appears safe to use for its stated purpose. Before installing, prefer a Python virtual environment for the dependencies, and remember that stock-analysis outputs and trading suggestions are informational rather than guaranteed or personalized financial advice.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

Installing this way could affect the user's Python environment or pull newer package versions than expected.

Why it was flagged

The setup command installs unpinned third-party Python packages and uses --break-system-packages, which can modify the system Python environment. This is disclosed and aligned with the tool's stock-analysis dependencies, but it is still worth user attention.

Skill content
pip3 install baostock pandas matplotlib --break-system-packages
Recommendation

Install the dependencies in a virtual environment when possible, and avoid --break-system-packages unless you understand the system-level impact.

#
ASI02: Tool Misuse and Exploitation
Info
What this means

Stock codes analyzed by the tool may be visible to the external market-data provider.

Why it was flagged

The code makes an external request to Sina Finance for real-time stock data, matching the SKILL.md disclosure that real-time prices come from Sina Finance.

Skill content
url = f'https://hq.sinajs.cn/list={sina_code}'
response = self.session.get(url, timeout=10)
Recommendation

Use the skill only for stock queries you are comfortable sending to the disclosed data providers.

#
ASI09: Human-Agent Trust Exploitation
Info
What this means

A user could rely too heavily on generated market predictions or buy/hold/reduce suggestions.

Why it was flagged

The skill is designed to generate predictions and trading-style recommendations. This is disclosed and purpose-aligned, and the SKILL.md includes a disclaimer, but users should not over-trust automated financial analysis.

Skill content
明日走势预测:基于技术评分给出概率判断
- ✅ 操作建议:明确给出买入/持有/减仓/观望建议
Recommendation

Treat outputs as educational technical analysis, not as personalized investment advice; verify with independent sources before making financial decisions.