Tushare Pro
PassAudited by ClawScan on May 1, 2026.
Overview
This appears to be a coherent read-only Tushare market-data skill, with the main things to notice being its API token requirement and unpinned Python dependencies.
This skill looks suitable for fetching Tushare market data, but install it only if you are comfortable providing a Tushare API token and installing the Python dependencies it requires. Protect the token like a password, and use the official Tushare site directly if you do not want to use the parameterized registration link.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone with access to the configured token may be able to use the user's Tushare API quota or paid permissions.
The skill asks the user to configure a Tushare API credential. This is expected for Tushare access, but the token can represent account/API privileges.
export TUSHARE_TOKEN="your-api-token-here"
Use a token intended for this purpose, avoid sharing shell configuration files, and rotate the token if it is exposed.
Installing dependencies trusts the maintainers and the package index for tushare and pandas.
The setup installs unpinned Python packages. This is normal for a Python-based Tushare wrapper, but it relies on the current packages available from the package index.
pip3 install tushare pandas --user
Install dependencies from a trusted environment, and consider pinning known-good package versions if reproducibility or supply-chain control matters.
Using the provided signup link may associate registration with that parameter.
The registration link includes an extra reg parameter rather than just the base Tushare site, which may indicate referral or registration tracking.
https://tushare.pro/weborder/#/login?reg=503098
If you prefer not to use a parameterized signup link, navigate to the official Tushare homepage directly.