Stocktoday Skill

• Analyzed: May 11, 2026, 6:23 AM
• Findings: 1
• Version: 1.1.5
• Hash: 59a12f064cb2793def9235b898427ee83fe51ab8418b88e9bff66a853c2bcf82
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a comprehensive Model Context Protocol (MCP) server for accessing over 200 Chinese A-share market data interfaces via the Tushare API. The implementation in 'src/index.ts' and 'HTTP_CLIENT.py' consists of standard HTTP POST requests to a primary API endpoint (tushare.citydata.club) and several hardcoded backup IP addresses for reliability. The code includes a failover mechanism and handles the API token via environment variables. No evidence of malicious intent, data exfiltration of local sensitive files, unauthorized command execution, or prompt injection was found; the network access is strictly aligned with the stated purpose of fetching financial data.