Gangtise 数据库

PassAudited by ClawScan on May 8, 2026.

Overview

This skill appears to be a coherent Gangtise financial-data client, but it does require Gangtise credentials and stores fetched CSV results locally.

Before installing, confirm you trust the publisher, store Gangtise credentials securely, and review large or all-market queries because they may send broad request parameters to Gangtise and save sizable CSV outputs locally.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone installing or running the skill may need to provide Gangtise API credentials that authorize access to the account’s data/API quota.

Why it was flagged

The skill uses Gangtise access credentials to obtain an authorization token. This is expected for the stated API integration, but users should treat these keys as sensitive.

Skill content

GTS_ACCESS_KEY = os.getenv("GTS_ACCESS_KEY", None)
GTS_SECRET_KEY = os.getenv("GTS_SECRET_KEY", None)
...
GTS_AUTHORIZATION = get_authorization(GTS_ACCESS_KEY, GTS_SECRET_KEY)

Recommendation

Use least-privileged Gangtise API keys if available, prefer environment variables over files when practical, and avoid sharing the scripts/.authorization file.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Running the skill can send requested securities/date ranges to Gangtise and create local CSV files with the returned data.

Why it was flagged

The skill intentionally runs local Python scripts, calls an external API, and saves results. This is disclosed and central to the skill’s purpose.

Skill content

本技能在**本机**调用 `scripts/*.py`，请求 **Gangtise Open API**（`open.gangtise.com`），得到**结构化、可保存为 CSV** 的结果

Recommendation

Review the requested securities, date ranges, and any --all-market or securities-file usage before running large queries.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users must rely mainly on the provided artifacts and registry entry to assess trustworthiness.

Why it was flagged

The artifact provenance is limited. This does not show malicious behavior, but users have less external context for verifying the package.

Skill content

Source: unknown
Homepage: none
No install spec — this is an instruction-only skill.

Recommendation

Install only if you trust the publisher and are comfortable with the reviewed local scripts and Gangtise API access.