Skills/ClawHub/ftshare-market-data

ftshare-market-data@1.0.10

VERIFIED· install only

Publisher claims: "非凸科技金融数据技能集(https://market.ft.tech/gateway/doc)。覆盖 A 股股票列表、行情、IPO、大宗交易、融资融券、单股行情估值、可转债、ETF、基金、指数（含分页指数描述、下载描述 PDF、权重汇总/成份明细、下载权重 xlsx、详情/K 线/分时）、宏观经济，以及港股公司介绍/估值分析/基础视图/K线、东财美股列表/历史K线/最新行情、 美股基础信息/利润表/现金流量表/资产负债表、港股财报三表(利润/现金流/资产负债)/东财港股指数日K线等接口。用户询问 A 股、港股、美股的代码、行情、估值、K线、指数权重/描述、新闻与宏观数据时使用。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher shawn92 · publishing for 139 daysInstalls 3,225Last detonated 2d ago
$clawhub install ftshare-market-data
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 90/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actionsub-skills/etf-pcf-download/SKILL.md:39 · File type combined with upload action — agent may exfiltrate local data filespython <RUN_PY> etf-pcf-download --filename pcf_159003_20260309.xml --output pcf_159003_20260309.xmlFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:36 · File type combined with upload action — agent may exfiltrate local data filespython <RUN_PY> etf-pcf-download --filename pcf_159003_20260309.xml --output pcf.xmlFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionrun.py:20 · File type combined with upload action — agent may exfiltrate local data filespython run.py etf-pcf-download --filename pcf_159003_20260309.xml --output pcf.xmlFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈74,105 tok
120 files · 253 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.