groundapi_a_share_analyst Security Report — Low Risk | ClawSafe

10 /100

groundapi_a_share_analyst

Analyze individual A-share stocks with real-time quotes, fundamentals, technicals, and recent news — powered by GroundAPI MCP tools.

This is a legitimate A-share stock analysis skill using declared MCP tools with no hidden functionality or malicious behavior detected.

Skill Namegroundapi_a_share_analyst

Duration24.2s

Enginepi

✓

Safe to install

Safe to use. The skill only accesses the declared GroundAPI MCP server and performs stock analysis using standard financial data APIs.

Findings 2 items

Severity	Finding	Location
Low	External API dependency The skill depends on an external GroundAPI MCP server for all data retrieval. If the service is compromised or goes offline, the skill will not function. `url: https://mcp.groundapi.net/sse` → Ensure you trust the GroundAPI service before using this skill.	`SKILL.md:28`
Low	API key in plain text SKILL.md contains a placeholder example for the GROUNDAPI_KEY. Users should replace sk_live_xxxxx with their actual key. `env: { "GROUNDAPI_KEY": "sk_live_xxxxx" }` → Do not use the placeholder key; obtain a valid key from GroundAPI.net	`SKILL.md:26`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`NONE`	`NONE`	—	No file operations described or required
Network	`READ`	`READ`	✓ Aligned	Uses declared MCP tools: finance_stock, info_search, finance_market
Shell	`NONE`	`NONE`	—	No shell execution in the skill
Environment	`READ`	`READ`	✓ Aligned	Only reads GROUNDAPI_KEY for MCP authentication
Skill Invoke	`READ`	`READ`	✓ Aligned	Uses standard MCP tool invocations
Clipboard	`NONE`	`NONE`	—	No clipboard access
Browser	`NONE`	`NONE`	—	No browser access
Database	`NONE`	`NONE`	—	No database access

2 findings

🔗

Medium External URL 外部 URL

https://groundapi.net

SKILL.md:9

🔗

Medium External URL 外部 URL

https://mcp.groundapi.net/sse

SKILL.md:28

1 files · 3.9 KB · 131 lines

Markdown 1f · 131L

└─ 📝 SKILL.md Markdown 131L · 3.9 KB

✓ No executable code - purely documentation specification

✓ All capabilities declared in SKILL.md match intended behavior

✓ No shell execution, filesystem manipulation, or credential harvesting

✓ Uses only standard MCP financial data tools

✓ No base64, eval, or suspicious encoding patterns

✓ No access to sensitive paths (~/.ssh, ~/.aws, .env, etc.)

✓ No hidden instructions or masquerading

✓ Clear disclaimer that analysis is for reference only