A股数据SKILL

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a read-only A-share market-data skill, with minor notes about third-party Python packages, external data APIs, and local caching.

This skill looks reasonable for read-only A-share data analysis. Before installing, be comfortable with installing its Python dependencies, contacting public market-data APIs, and using local caches; review commands before large batch or all-market requests.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A package update or compromised dependency could affect the skill's behavior in the user's Python environment.

Why it was flagged

The skill relies on several third-party Python packages without version pins. This is purpose-aligned for market-data retrieval but means installed behavior can depend on upstream package versions.

Skill content

pip install akshare MyTT pandas numpy requests

Recommendation

Install in an isolated environment and consider pinning or reviewing package versions before use.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Stock or market queries may be sent to external data services when using those features.

Why it was flagged

The realtime script can call external APIs for market news and board data. This is related to the skill's stated market-data purpose, but it expands the set of third-party services contacted.

Skill content

MARKET_NEWS_URL = "https://dang-invest.com/api/market/news"
BOARDS_SUMMARY_URL = "https://dang-invest.com/api/market/boards/summary"
BOARDS_DETAIL_URL = "https://dang-invest.com/api/market/boards/detail"

Recommendation

Review generated commands for news, boards, and batch queries, and avoid sending private investment strategy details if that matters to you.

Low

#ASI06: Memory and Context Poisoning

What this means

The agent may answer from cached public market-reference data rather than freshly fetched data.

Why it was flagged

The script stores retrieved public A/H stock data in a local cache for later reuse. This is expected for performance, but cached data can become stale or influence later answers.

Skill content

cache_file = script_dir.parent / "cache" / "ah_stocks.json"
ttl_sec = 12 * 3600

Recommendation

Use the documented no-cache option or clear the cache when freshness is important.