Scan Report
5 /100
groundapi_market_briefing
Generate a daily A-share market briefing covering indices, sector rotation, top movers, and key financial news — powered by GroundAPI MCP tools
A minimal, documentation-only skill that generates A-share market briefings via declared MCP tools with no executable code, scripts, or hidden functionality.
Safe to install
No action needed. This skill is safe to use as it contains only declarative documentation without any executable code.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | NONE | — | No file operations described or implemented |
| Network | READ | READ | ✓ Aligned | External API calls to mcp.groundapi.net/sse documented in SKILL.md lines 27-32 |
| Shell | NONE | NONE | — | No shell commands or subprocess calls found |
| Environment | READ | READ | ✓ Aligned | GROUNDAPI_KEY required, declared in metadata (line 5) |
| Skill Invoke | READ | READ | ✓ Aligned | MCP tools (finance_market, finance_stock_screen, info_news) explicitly declared … |
| Clipboard | NONE | NONE | — | No clipboard access described or implemented |
| Browser | NONE | NONE | — | No browser automation described or implemented |
| Database | NONE | NONE | — | No database access described or implemented |
2 findings
Medium External URL 外部 URL
https://groundapi.net SKILL.md:9 Medium External URL 外部 URL
https://mcp.groundapi.net/sse SKILL.md:28 File Tree
1 files · 2.8 KB · 99 lines Markdown 1f · 99L
└─
SKILL.md
Markdown
Security Positives
✓ No executable code - skill contains only declarative documentation
✓ All external API usage (groundapi.net) is explicitly declared in SKILL.md
✓ Required environment variable (GROUNDAPI_KEY) is declared in metadata
✓ No scripts, dependencies, or package files that could contain hidden functionality
✓ No sensitive path access (ssh, aws, .env files)
✓ No network calls to raw IP addresses or suspicious endpoints
✓ No base64-encoded or obfuscated content
✓ No credential harvesting or data exfiltration patterns