akshare-stock-analysis Security Report — Low Risk | ClawSafe

15 /100

akshare-stock-analysis

Professional stock analysis skill using AKShare data + technical indicators + sector rotation + portfolio diagnosis

Legitimate stock analysis skill using documented public APIs with no undeclared capabilities or malicious behavior detected.

Skill Nameakshare-stock-analysis

Duration33.5s

Enginepi

✓

Safe to install

Skill appears safe for use. Consider pinning dependency versions for production stability.

Findings 2 items

Severity	Finding	Location
Low	Dependencies without version pinning SKILL.md instructs 'pip install akshare --upgrade' and pandas/numpy without version constraints, potentially installing incompatible or vulnerable versions `pip install akshare --upgrade pip install pandas numpy` → Specify version constraints: pip install akshare==1.x.x pandas==x.x.x numpy==x.x.x	`SKILL.md:18`
Info	requests library not declared in documentation The script imports and uses requests library directly but SKILL.md only mentions akshare/pandas/numpy dependencies `import requests` → Document all dependencies in SKILL.md	`scripts/akshare_cli.py:9`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`NONE`	`NONE`	—	No file operations in code
Network	`READ`	`READ`	✓ Aligned	HTTP GET to qt.gtimg.cn and akshare API
Shell	`NONE`	`NONE`	—	No subprocess or shell execution
Environment	`NONE`	`NONE`	—	No os.environ access

2 findings

🔗

Medium External URL 外部 URL

https://qt.gtimg.cn/q=

scripts/akshare_cli.py:19

📧

Info Email 邮箱地址

[email protected]

SKILL.md:5

2 files · 14.1 KB · 441 lines

Python 1f · 232L Markdown 1f · 209L

├─ ▾ 📁 scripts

│ └─ 🐍 akshare_cli.py Python 232L · 8.6 KB

└─ 📝 SKILL.md Markdown 209L · 5.5 KB

Package	Version	Source	Known Vulns	Notes
`akshare`	`*`	pip	No	No version constraint, uses --upgrade flag
`pandas`	`*`	pip	No	Not pinned
`numpy`	`*`	pip	No	Not pinned
`requests`	`*`	pip	No	Used directly, not documented as dependency

✓ No credential harvesting or sensitive path access (~/.ssh, ~/.aws, .env)

✓ No data exfiltration or suspicious network destinations

✓ No base64 encoding, obfuscation, or hidden payloads

✓ No reverse shell, C2, or malicious code patterns

✓ All network requests go to legitimate financial data APIs (Tencent, East Money)

✓ No subprocess or shell command execution

✓ Code is straightforward and matches documented functionality