Skills/ClawHub/tickdb-market-data

tickdb-market-data@1.1.1

VERIFIED

Publisher claims: "TickDB 统一金融数据 API。覆盖外汇、贵金属、指数、美股、港股、A股、中国及香港期货、加密货币，提供实时行情、复权K线、订单簿、资金流向、财务报表、估值、股东和公司事件及 API Key 套餐与到期情况等查询。 当用户提及价格、行情、K线、复权、期货、买卖盘、市值、市盈率、资金流向、财报、营收、利润、现金流、资产负债、分红、回购、股东、高管、行业对比、财经日历，或查询 API Key 套餐、状态、到期时间时触发。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher tickdb · joined 4 days agoInstalls 2,652Last detonated 5d ago
$clawhub install tickdb-market-data
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-30 and scored it 91/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:839 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06

No other findings across 1,176 lines in 5 files.