Agent Economy ReportAgent Economy ReportSAFE version 1.0.0 · audited 2026-09-09
This is a documentation-only skill: three markdown files and a metadata file, with no scripts, no code, and no executable commands. It tells the agent how to look up a stock price with a web search and then present a formatted analysis (price table, technical notes, and a buy/hold/sell suggestion) in Chinese, and it includes a reference list of common Chinese, Hong Kong and US ticker symbols. The only external destinations mentioned are well-known public finance sites (Eastmoney, Xueqiu, Yahoo Finance, Google Finance) listed as suggested data sources, not as endpoints the skill contacts directly. There is no access to credentials, files, shell, payments, or persistence, and nothing is sent anywhere. The real caution is subject-matter, not security: the skill instructs the agent to issue buy/sell recommendations, which a user could mistake for financial advice, although the skill does require a risk disclaimer. Content-wise it is safe to install.
| Declared purpose | Analyze Chinese A-share, Hong Kong and related US stock prices from public web data and present structured analysis with buy/hold/sell recommendations. |
| Observed behavior | Provides prompt instructions and a reference table only. It directs the agent to perform a web search for current price and news, then format the result into a markdown template with a technical-analysis section, a recommendation, and a mandatory Chinese-language investment risk disclaimer. No file, network, or system operations are coded anywhere in the package. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | The workflow relies on the agent's own web search to fetch price data (SKILL.md line 23); public finance sites are named as sources in references/china-stocks.md lines 91-94. No hardcoded requests or hidden endpoints exist in the package. |
| severity | finding |
|---|---|
| low | Skill instructs the agent to issue explicit buy/sell recommendations The template requires a directive trade recommendation (buy/hold/sell) plus an 'operating strategy'. This is the declared purpose, but output could be mistaken for personalized financial advice; in an agent that can place trades or spend money, such output should not be acted on automatically. SKILL.md:51 **建议：买入/持有/卖出** |
| info | Depends on the agent's web search capability The skill has no code of its own and delegates all data gathering to the host agent's web search tool. Accuracy and freshness of any figures depend entirely on whatever pages the search returns. SKILL.md:23 1. **Search for current price data** using web search |
| info | External data sources are named but not contacted by the package Eastmoney, Xueqiu, Yahoo Finance and Google Finance appear only as suggested reference links in markdown. No automated fetching, credential use, or upload of data to these or any other domain is implemented. references/china-stocks.md:91 - 东方财富网：https://www.eastmoney.com |
| info | Risk disclaimer required by the skill The skill mandates a Chinese-language disclaimer stating the analysis is for reference only and not investment advice, which partially mitigates the recommendation risk. SKILL.md:78 Always include: "分析仅供参考，不构成投资建议。投资有风险，入市需谨慎。" |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:7 |
| finance.yahoo.com | not in the service index | references/china-stocks.md:93 |
| www.eastmoney.com | not in the service index | references/china-stocks.md:91 |
| www.google.com | not in the service index | references/china-stocks.md:94 |
| xueqiu.com | not in the service index | references/china-stocks.md:92 |
| Binaries invoked | none |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 82 | 274b88c93b57f711… |
_meta.json | 6 | 70e0edafa5221520… |
references/china-stocks.md | 94 | 07d8845ce8e08966… |
skill-card.md | 46 | 183b6be684ae10b5… |
For agents
JSON: https://agenteconomy.report/k/china-stock-analysis.audit.json · badge: https://agenteconomy.report/k/china-stock-analysis.audited.svg ·
skill rating: /k/china-stock-analysis · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).