Agent Economy ReportAgent Economy ReportSAFE version 1.0.1 · audited 2026-09-17
This skill is a stock-data helper for China A-shares. It provides instructions for installing an external Python library called AkShare and examples for retrieving quotes, price history, financial data, sector data, fund flows, IPO data and margin-trading data. A small command-line helper script is included that prints JSON results to the terminal and does not write files or store data. The only notable behavior beyond local code is that the library makes network requests to market-data sources, which is required for the skill's stated purpose. There is no observed credential handling, payment redirection, persistence, or hidden download-and-execute behavior. One function appears broken because it calls a name without the required prefix, but that is a reliability issue, not a security issue.
| Declared purpose | A股量化数据分析工具，基于AkShare库获取A股行情、财务数据、板块信息等。用于回答关于A股股票查询、行情数据、财务分析、选股等问题。 |
| Observed behavior | The package contains documentation and a Python CLI script. The documentation shows AkShare calls for real-time quotes, historical K-lines, financial data, sector data, fund flows, dragon-tiger list, IPOs, margin trading, and a Baostock fallback. The script imports akshare, performs similar lookups, parses command-line arguments, prints JSON to stdout, and exits on error. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | The AkShare library fetches A-share market data from upstream web sources; observed at scripts/stock_cli.py lines 19, 30, 42, 48 and 60, and in SKILL.md examples. |
| install_packages | needed | SKILL.md line 12 instructs `pip install akshare`, which is required for the skill's data functions. |
| shell | needed | SKILL.md documents bash/pip commands and Python code; the CLI is a Python script with a shebang at scripts/stock_cli.py line 1. |
| severity | finding |
|---|---|
| info | Declared purpose The front-matter description matches the skill contents: A-share quantitative data analysis with AkShare. SKILL.md:3 A股量化数据分析工具，基于AkShare库获取A股行情、财务数据、板块信息等。用于回答关于A股股票查询、行情数据、财务分析、选股等问题。 |
| low | Installs third-party Python package The setup instructions tell the user or agent to install the AkShare package with pip. This is necessary for the stated data functions but pulls third-party code and dependencies. SKILL.md:12 pip install akshare |
| info | Network data retrieval The script calls AkShare, which makes network requests to retrieve A-share market data. Network access is needed for the declared purpose. scripts/stock_cli.py:19 df = ak.stock_zh_a_spot_em() |
| low | Fund-flow function likely broken The code imports akshare as ak but calls `stock_individual_fund_flow` without the `ak.` prefix. Since no such global is defined, this action likely raises NameError. This is a reliability defect, not a security issue. scripts/stock_cli.py:54 df = stock_individual_fund_flow(stock=stock, market="sh") |
| info | Output is printed to stdout The CLI prints JSON results to standard output. No local file writes or persistence behavior are present in the script. scripts/stock_cli.py:80 print(json.dumps(data[:5], ensure_ascii=False, indent=2)) |
| info | Publisher discloses network dependency The skill card acknowledges outbound network requests for market data. This matches observed behavior. skill-card.md:28 Risk: The skill makes network requests to retrieve A-share market data, and upstream websites may change or be unavailable. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | bash, pip, python, python3, sh |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 154 | eaf0dfd766c0fef8… |
_meta.json | 6 | 6c47e29db872edc0… |
scripts/stock_cli.py | 117 | 7ce250f9921f0d0e… |
skill-card.md | 60 | d659200732f09245… |
For agents
JSON: https://agenteconomy.report/k/akshare-stock.audit.json · badge: https://agenteconomy.report/k/akshare-stock.audited.svg ·
skill rating: /k/akshare-stock · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).