Akshare

• Analyzed: May 12, 2026, 4:22 AM
• Findings: 1
• Version: 1.0.0
• Hash: 0a4095e195a28fb4df5e686db26bd798f5907c8b38aef83581f37ebe9c126183
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is generally benign, providing access to Chinese financial data via the AKShare library. However, the `scripts/get_stock_history.py` file contains a potential path traversal vulnerability. It constructs an output filename using unsanitized command-line arguments (`symbol`, `start_date`, `end_date`), which could allow an attacker to write the generated CSV file to an arbitrary location on the filesystem if they can control these inputs. This is a vulnerability due to lack of input sanitization, not an indication of intentional malicious behavior like data exfiltration or backdoor installation.