中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 15/100
上次扫描：2 天前 重新扫描
15 /100
akshare-stock-analysis
Professional stock analysis skill using AKShare data + technical indicators + sector rotation + portfolio diagnosis
Legitimate stock analysis skill using documented public APIs with no undeclared capabilities or malicious behavior detected.
技能名称akshare-stock-analysis
分析耗时33.5s
引擎pi
✓
可以安装
Skill appears safe for use. Consider pinning dependency versions for production stability.

安全发现 2 项

严重性 安全发现 位置
低危
Dependencies without version pinning
SKILL.md instructs 'pip install akshare --upgrade' and pandas/numpy without version constraints, potentially installing incompatible or vulnerable versions
pip install akshare --upgrade
pip install pandas numpy
→ Specify version constraints: pip install akshare==1.x.x pandas==x.x.x numpy==x.x.x
 SKILL.md:18
提示
requests library not declared in documentation
The script imports and uses requests library directly but SKILL.md only mentions akshare/pandas/numpy dependencies
import requests
→ Document all dependencies in SKILL.md
 scripts/akshare_cli.py:9
资源类型声明权限推断权限状态证据
文件系统 NONE NONE — No file operations in code
网络访问 READ READ ✓ 一致 HTTP GET to qt.gtimg.cn and akshare API
命令执行 NONE NONE — No subprocess or shell execution
环境变量 NONE NONE — No os.environ access
2 项发现
🔗
中危 外部 URL 外部 URL
https://qt.gtimg.cn/q=
scripts/akshare_cli.py:19
📧
提示 邮箱 邮箱地址
[email protected]
SKILL.md:5

目录结构

2 文件 · 14.1 KB · 441 行
Python 1f · 232L Markdown 1f · 209L
├─ ▾ 📁 scripts
│ └─ 🐍 akshare_cli.py Python 232L · 8.6 KB
└─ 📝 SKILL.md Markdown 209L · 5.5 KB

依赖分析 4 项

包名版本来源已知漏洞备注
akshare * pip 否 No version constraint, uses --upgrade flag
pandas * pip 否 Not pinned
numpy * pip 否 Not pinned
requests * pip 否 Used directly, not documented as dependency

安全亮点

✓ No credential harvesting or sensitive path access (~/.ssh, ~/.aws, .env)
✓ No data exfiltration or suspicious network destinations
✓ No base64 encoding, obfuscation, or hidden payloads
✓ No reverse shell, C2, or malicious code patterns
✓ All network requests go to legitimate financial data APIs (Tencent, East Money)
✓ No subprocess or shell command execution
✓ Code is straightforward and matches documented functionality