v1.0.0

Stock Data Export

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:33 AM.

Analysis

The skill coherently describes exporting Tushare stock-market data, with only minor setup-related notes about using a Tushare API token and dependency metadata.

GuidanceThis appears safe and purpose-aligned for exporting market data. Before installing or using it, confirm you are comfortable providing a Tushare API token and, if any package installation is required, install the official Tushare package from a trusted source.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

_meta.json

"requirements": ["tushare"]

The metadata references a Tushare dependency but does not pin a version or provide an install specification. This is aligned with the skill purpose, but users should verify the package source if they install it.

User impactIf a dependency is installed manually, package provenance and version may affect reliability and safety.

RecommendationInstall dependencies from the official package source and consider pinning a known-good version in your own environment.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

需要配置 Tushare API Token：
```
tushare_token=你的 token
```

The skill requires a service API token. This is expected for Tushare data access, but it is still credential material that users should not expose unnecessarily.

User impactYou may need to provide a Tushare API token for the export workflow to work.

RecommendationUse a token intended only for Tushare data access, avoid pasting it into unrelated contexts, and revoke or rotate it if exposed.