All-Market Financial Data Hub

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears purpose-aligned for querying Eastmoney financial data, with expected notes around API key use, external provider requests, and Python dependency installation.

Before installing, make sure you are comfortable providing an Eastmoney EM_API_KEY, sending your financial query text to Eastmoney's API, and installing the listed Python dependencies in your environment.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use your Eastmoney API quota or account-authorized access when making financial data requests.

Why it was flagged

The skill requires an Eastmoney API key for authentication, which is expected for the advertised data service and is clearly disclosed.

Skill content

本技能仅使用一个环境变量：`EM_API_KEY`。 ... 用于其接口鉴权。

Recommendation

Use a scoped, revocable API key if available, and do not paste the key into prompts, logs, or shared files.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Confidential investment research questions or entity lists could be visible to the Eastmoney service when queried.

Why it was flagged

The script sends the user's natural-language financial query to an external Eastmoney API endpoint, which is purpose-aligned but means query contents leave the local environment.

Skill content

DEFAULT_SEARCH_API_URL = ("https://ai-saas.eastmoney.com/proxy/b/mcp/tool/searchData") ... return {"query": query, "toolContext": ...}

Recommendation

Avoid sending sensitive or restricted research queries unless your organization permits use of this provider and endpoint.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Dependency versions may vary across systems, and installation depends on the trustworthiness of the package source used by pip.

Why it was flagged

The skill relies on installing Python packages without pinned versions; this is common for Python skills but gives package resolution to the user's Python package index at install time.

Skill content

pip3 install httpx pandas openpyxl --user

Recommendation

Install in a controlled Python environment and consider pinning or auditing dependency versions if used in a sensitive workflow.