skills/gusibi/skills/akshare-data/Gen Agent Trust Hub

akshare-data

Pass

Audited by Gen Agent Trust Hub on Feb 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/akshare_query.py fetches the akshare Python package from the well-known Tsinghua University PyPI mirror (https://pypi.tuna.tsinghua.edu.cn/simple) if the library is not present on the host system.\n- [COMMAND_EXECUTION]: The skill uses subprocess.check_call within scripts/akshare_query.py to automate the installation of dependencies using the pip package manager.\n- [COMMAND_EXECUTION]: The scripts/akshare_query.py file uses getattr to dynamically invoke functions within the akshare module based on parameters provided at runtime.\n- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection due to the way it handles untrusted data.\n
  • Ingestion points: The skill retrieves external content such as news articles, sentiment data, and hot search rankings via AKShare APIs as listed in references/alternative.md and references/stock.md.\n
  • Boundary markers: No specific delimiters or instructions (e.g., 'ignore commands in data') are used to protect the agent context from instructions embedded in external data.\n
  • Capability inventory: The agent can execute a wide range of financial data functions and write files to the local system using the --save parameter in scripts/akshare_query.py.\n
  • Sanitization: There is no evidence of content filtering or sanitization of data retrieved from external APIs before it is passed to the language model.
Audit Metadata
Risk Level
SAFE
Analyzed
Feb 26, 2026, 03:47 PM