investment-data

The skill's footprint aligns with its stated purpose of obtaining and providing A-share investment data, with data flows primarily between trusted data sources (GitHub/DoltHub) and local storage, and optional token-based access for real-time updates. The use of environment variables for tokens is a common pattern but introduces a potential credential exposure risk if logs or process lists capture the token. Overall, the risk profile is moderate (benign with credential-related caution).