Skills/ClawHub/a-stock-daily-market-sense

a-stock-daily-market-sense@2.0.2

CAUTION· static only

Publisher claims: "基于 Tushare Pro A 股日线与 Baostock 风格指数生成盘后市场研报。当用户要求分析每日或历史盘面、指数与市场风格、情绪和成交额集中度、赚钱效应与上涨主线、即时及短中期催化、主线细分线路、爆量下跌，或容量上涨、全市场月线平台突破、10:30 前涨停、折扣启动等特征分组时使用；也用于特征分组量化回..." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher chinfi-codex · publishing for 167 daysInstalls 1,481Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-11 and scored it 57/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

HIGH
Access to sensitive file pathsscripts/market_panel.py:184 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_path = os.path.join(os.getcwd(), ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/_shared/web_search/tavily_search.py:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files从环境变量或就近的 .env 读 TAVILY_API_KEY，调用 Tavily Search API，把结构化Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/_shared/web_search/tavily_search.py:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescandidates = [Path.cwd() / ".env"]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/market_panel.py:179 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Read TUSHARE_TOKEN from the environment or cwd/.env."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/_shared/web_search/tavily_search.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""TAVILY_API_KEY：优先环境变量，否则就近的 .env（cwd 或脚本上溯的仓库根）。"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/_shared/web_search/tavily_search.py:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""从单个 .env 文件里读 TAVILY_API_KEY（容错，读不到返回空串）。"""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/_shared/web_search/tavily_search.py:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescandidates += [parent / ".env" for parent in list(here.parents)[:6]]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
URL with embedded credentialsscripts/_shared/html_report/builder.py:37 · URL with embedded credentials — may be phishing or credential leaking' <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsscripts/market_panel.py:202 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesraise RuntimeError("Missing TUSHARE_TOKEN. Set it in the environment or cwd/.env.")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionscripts/render_report_html.py:1208 · File type combined with upload action — agent may exfiltrate local data fileshelp="Evidence JSON path. Defaults to sibling evidence_YYYYMMDD_utf8.json when input is report_YYYYMMDD.md.",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/market_panel.py:4970 · File type combined with upload action — agent may exfiltrate local data files"aggregation_inputs": ["assembled_checks.json", "references/methodology/output_discipline.md"],Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:27 · File type combined with upload action — agent may exfiltrate local data files…me_id）和生命周期状态判定（低位启动/在场候选/主线确认/高位分歧/退潮/修复/再聚焦/沉寂），写出 `reports/lifecycle_YYYYMMDD.json` 后运行 `python3 scripts/theme_lifecycle.py record --input reports/lifecycle_YYYYMMDD.json` 落库。脚本只做确定性校验（枚举、状态机转移合法性、theme_id 存在性），判断留给模型；…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:26 · File type combined with upload action — agent may exfiltrate local data files…与模板，完成 3.1 主线判定、3.2 催化与细分线路推演、3.3 领导股与弹性股。主 agent 再读取模块 1-5 输出、`assembled_checks.json` 与 `references/methodology/output_discipline.md`，补一句话盘面判断、风险传导提示和最终语气校准。搜索或知识查询失败不阻断日报，但要披露证据缺口并降低产业推演确定性。 6. 主线生…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈2,652 tok
1 file · 51 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

23 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim chinfi-codex: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim chinfi-codexPropose a patch to the maintainer