tushare-data

Pass

Audited by Gen Agent Trust Hub on Mar 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches a wide range of financial data, including stock prices, fund net values, macroeconomic indicators, and news from the Tushare Pro API (tushare.pro). This behavior is the central purpose of the skill and uses the official provider's infrastructure.
  • [COMMAND_EXECUTION]: Executes Python scripts (scripts/stock_data_demo.py and scripts/fund_data_demo.py) that utilize the Tushare SDK to retrieve, process, and display data. These scripts are transparent and perform only intended data operations.
  • [CREDENTIALS_UNSAFE]: Security is maintained by requiring the TUSHARE_TOKEN to be provided as an environment variable. The skill correctly identifies this as sensitive data in its configuration and does not include any hardcoded secrets.
  • [PROMPT_INJECTION]: The skill processes external data such as corporate announcements and news reports (via the news and anns_d interfaces). While this constitutes a surface for indirect prompt injection where malicious instructions could be embedded in financial text, the skill is designed for information retrieval and summary, reducing the risk of unauthorized action execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 26, 2026, 07:33 AM