Global Macro Database Assistant

PassAudited by ClawScan on May 1, 2026.

Overview

The skill appears purpose-aligned for querying Eastmoney macroeconomic data, but users should notice that it uses an API key, installs a Python dependency, and may perform bounded follow-up checks for completeness.

Before installing, make sure you trust the Eastmoney service and the skill publisher, provide only a revocable EM_API_KEY, expect queries to be sent to the provider, and monitor any repeated completeness retries if API usage or quota matters.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may read the generated CSV files and make additional API calls before responding, which can increase latency or consume API quota.

Why it was flagged

The skill tells the upper agent to use code/file-reading capability and make iterative follow-up calls. This is bounded and related to completeness, but it expands the action sequence beyond a single query.

Skill content

使用规划引擎内置的代码执行能力（如 Python Sandbox）读取 CSV ... 再次调用 `mx_macro_data` ... 最大重试次数5次

Recommendation

Keep retries within the documented limit, restrict file reads to files generated by this skill, and ask the user before broadening the query scope or using paid/limited API quota.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone installing the skill must provide an Eastmoney API key, and calls made by the skill may count against that account or quota.

Why it was flagged

The code reads an environment API key and sends it as an authentication header. This is expected for the Eastmoney API integration, but it is still credential use.

Skill content

EM_API_KEY = os.environ.get("EM_API_KEY", "") ... "em_api_key": EM_API_KEY

Recommendation

Use a scoped and revocable API key, avoid sharing it in prompts or logs, and rotate it if it may have been exposed.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the dependency pulls code from the Python package ecosystem, which may vary over time if versions are not pinned.

Why it was flagged

The skill depends on the external Python package httpx without a pinned version. This is a normal, purpose-aligned dependency for HTTP requests, but upstream dependency changes can affect behavior.

Skill content

"package": "httpx" ... pip3 install httpx --user

Recommendation

Install from a trusted package index and consider pinning a reviewed httpx version in controlled environments.