financial-market-data

This skill appears to implement market-data fetchers for many public sources, which matches its description, but it embeds a concrete EastMoney MX API key/token in skill.yaml and in python/template.py while declaring no required credentials. Before installing: (1) Treat the embedded API key as suspicious — decide whether you want to use it or replace it with your own key; hard-coded keys can be revoked, rate-limited, or violate a provider's terms. (2) Review and, if needed, remove the hard-coded key from template.py and skill.yaml, and update the code to read credentials from environment variables or a user-provided config. (3) Install and run in an isolated environment (virtualenv/container) because the skill will perform outbound network calls to several third-party hosts (10jqka/dfcfs/push2/eastmoney and a pytdx host IP). (4) Verify the third-party Python packages (tickflow/akshare/baostock/pytdx) are from trusted sources and pin versions if you plan to deploy. (5) If you require stronger assurance, request the upstream/source author or a signed release and clarify why a provider token is embedded in distributed metadata. These inconsistencies make the package suspicious but not demonstrably malicious.