tushare-data
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a wide range of financial data, including stock prices, fund net values, macroeconomic indicators, and news from the Tushare Pro API (tushare.pro). This behavior is the central purpose of the skill and uses the official provider's infrastructure.
- [COMMAND_EXECUTION]: Executes Python scripts (
scripts/stock_data_demo.pyandscripts/fund_data_demo.py) that utilize the Tushare SDK to retrieve, process, and display data. These scripts are transparent and perform only intended data operations. - [CREDENTIALS_UNSAFE]: Security is maintained by requiring the
TUSHARE_TOKENto be provided as an environment variable. The skill correctly identifies this as sensitive data in its configuration and does not include any hardcoded secrets. - [PROMPT_INJECTION]: The skill processes external data such as corporate announcements and news reports (via the
newsandanns_dinterfaces). While this constitutes a surface for indirect prompt injection where malicious instructions could be embedded in financial text, the skill is designed for information retrieval and summary, reducing the risk of unauthorized action execution.
Audit Metadata