tushare
v1.1.16面向中文自然语言的 Tushare 数据研究技能。用于把“看看这只股票最近怎么样”“帮我查财报趋势”“最近哪个板块最强”“北向资金在买什么”“给我导出一份行情数据”这类请求，转成可执行的数据获取、清洗、对比、筛选、导出与简要分析流程。适用于 A 股、指数、ETF/基金、财务、估值、资金流、公告新闻、板块概念与宏观...
⭐ 31· 10.4k·119 current·122 all-time
by@lidayan
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (Tushare data research) align with included SKILL.md, reference doc, and the two demo scripts which call the tushare Python SDK. The capabilities requested (data pulls, exports, summaries) match the stated purpose.
Instruction Scope
SKILL.md instructs the agent to check Python availability, the 'tushare' package, and the TUSHARE_TOKEN before making API calls. Runtime instructions stay within the data-access and processing scope; they do not request unrelated files, system-wide secrets, or unknown external endpoints.
Install Mechanism
There is no install spec (instruction-only). The SKILL.md lists a Python package dependency ('tushare'), which is expected. No downloads from arbitrary URLs or archive extraction are present in the manifest or scripts.
Credentials
The skill legitimately requires a TUSHARE_TOKEN (sensitive) for API access and network connectivity; the SKILL.md documents this. Minor inconsistency: registry metadata in the header reports 'Required env vars: none', while SKILL.md declares TUSHARE_TOKEN (required: false but sensitive) and the demo scripts call pro_api() without passing a token (so they rely on an env/config token). This is explainable but worth noting before install.
Persistence & Privilege
The skill is not always:true, does not request system-wide persistence, and contains no instructions to modify other skills' configs or store unrelated credentials. Autonomous invocation is allowed (platform default) but is not combined with other concerning privileges.
Assessment
This skill appears to do what it says: fetch and prepare Tushare financial data. Before installing, ensure you have: (1) a valid TUSHARE_TOKEN (set in your environment or passed to ts.pro_api), (2) network access, and (3) Python with the 'tushare' package. Note the registry metadata omitted the TUSHARE_TOKEN requirement even though SKILL.md and the demo scripts expect it—confirm where to store the token and whether the environment variable will be provided. The skill does not request unrelated credentials or try to modify system settings. If you require provenance, prefer skills with a published homepage or known owner; this package's source/homepage are missing, which lowers confidence slightly but does not indicate malicious behavior.Like a lobster shell, security has layers — review code before you run it.
latestvk974xzhjtnkc6pdh2et87sbxex84mavz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.