Housing Price Data

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This looks like a benign public-data fetcher that runs local Python code and contacts stats.gov.cn, with no evidence of credential use, hidden data access, or destructive behavior.

This skill appears suitable for fetching public official housing index data. Before installing or using it, be aware that it runs included Python scripts, may need Python dependencies, contacts stats.gov.cn, and can write chart files if requested.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

Using the skill may execute the included Python script, make web requests to the statistics site, and optionally create chart files.

Why it was flagged

The skill directs the agent to run a local Python script that fetches external public data; this is disclosed and fits the housing-price data purpose.

Skill content
运行时需要能访问 `stats.gov.cn` ... python3 scripts/fetch_data.py --city <城市> --metrics <指标> --latest
Recommendation

Use explicit city, metric, limit, and output-path arguments, and allow network access only if fetching current official data is desired.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

If dependencies are installed or updated, the exact package versions may vary across environments.

Why it was flagged

The dependency versions are lower-bound ranges rather than pinned versions, so a future install could resolve to newer package versions.

Skill content
requests>=2.28.0
beautifulsoup4>=4.11.0
matplotlib>=3.5.0
Recommendation

Prefer a lockfile or pinned dependency versions if reproducible installation is important.