v1.0.2

东方财富日内行情 dfcf-stock-intraday

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:12 AM.

Analysis

This instruction-only skill is narrowly focused on fetching public Eastmoney intraday stock or index data and shows no credential, file, persistence, or account-mutation behavior.

GuidanceThis appears safe for its stated purpose. Before installing, understand that it will make HTTPS requests to Eastmoney for the stock or index you ask about; verify ticker/secid values and treat the returned market data as informational.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

在 bash 中运行以下命令（将 `<secid>` 替换为实际值）：

curl -s "https://push2.eastmoney.com/api/qt/stock/trends2/get?...&secid=<secid>"

The skill tells the agent to run a local curl command using a secid derived from the user's requested stock or index. This shell/API use is expected for the purpose, but users should know it will execute a command and send the requested identifier to Eastmoney.

User impactA requested stock or index identifier may be sent to Eastmoney to retrieve public market data; no local files, credentials, or account actions are shown.

RecommendationUse the skill for market-data queries, and keep secid values to the documented numeric market.code format before running the curl command.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown
Homepage: none

The artifact provenance is limited because no source repository or homepage is provided. This is a low-risk transparency note here because the skill is instruction-only and the visible behavior is simple.

User impactUsers have less external context for who maintains the skill or where to verify its instructions.

RecommendationReview the visible SKILL.md instructions and the Eastmoney endpoint before relying on the skill.