Skills of A-share holder data released by ft.tech.

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a read-only market-data skill that runs bundled Python helpers and queries market.ft.tech, with no evidence of credential use, persistence, or data changes.

This skill looks safe for read-only A-share market data queries if you are comfortable with the agent running the included Python scripts and sending requested stock codes to market.ft.tech. Prefer the documented subskill names and treat returned financial data as informational rather than authoritative investment advice.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI05: Unexpected Code Execution

What this means

Using the skill allows the agent to run the included Python handlers to fetch the requested market data.

Why it was flagged

The skill runs a selected bundled handler as a Python subprocess. This is expected for the skill design, but it means the agent will execute local Python code when using the skill.

Skill content

result = subprocess.run(
        [sys.executable, handler] + sys.argv[2:],
        cwd=SKILL_ROOT,
    )

Recommendation

Use only the documented subskill names; maintainers could further reduce risk by allowlisting valid subskills in run.py.

Info

#ASI02: Tool Misuse and Exploitation

What this means

The stock symbols and related query parameters you ask about may be sent to market.ft.tech.

Why it was flagged

The skill clearly discloses that it calls an external market data API over HTTP GET; handlers send stock-code and paging parameters to that provider.

Skill content

所有接口均以 `https://market.ft.tech` 为基础域名，使用 HTTP GET。

Recommendation

Use the skill for non-sensitive market lookups and verify that you trust the market.ft.tech data source and terms.