← Back to Skills Marketplace
tushare股票数据源
by
ghjkkkkkklkk
· GitHub ↗
· v1.0.1
· MIT-0
318
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install tushare-stock-data
Description
提供基于股票代码从Tushare获取A股股票基础数据，支持自定义返回条数。
Usage Guidance
Do not install or run this skill as-is. The included Python file contains a hardcoded Tushare API token — using the skill will expose that token and use someone else's credentials for API calls. Ask the author to remove the embedded token and instead declare a required TUSHARE_TOKEN environment variable (document it in SKILL.md). If this token belongs to you, rotate/revoke it immediately and replace it with a personal token supplied via a secure env var. Also request that the skill manifest declare its dependency on the 'tushare' Python package so you can install it deliberately. If you must test, run it in an isolated environment and avoid using production credentials.
Capability Analysis
Type: OpenClaw Skill
Name: tushare-stock-data
Version: 1.0.1
The skill contains a hardcoded Tushare API token in main.py (885cd28a17a52b35e5da6abb8ac11e20e85483affa4c4de8a9e6a928). While the code appears to function as described to fetch stock data, hardcoding credentials is a significant security vulnerability and a leaked secret, which warrants a suspicious classification despite the lack of other malicious indicators.
Capability Assessment
Purpose & Capability
The skill's purpose (querying Tushare for A-share basic data) matches what the code does, but the manifest declares no required credentials while the code unconditionally sets a Tushare token. A properly designed skill would ask the user to provide their own TUSHARE token via an environment variable or configuration rather than embedding one.
Instruction Scope
SKILL.md describes inputs/outputs and does not mention authentication or a token, yet main.py sets and uses a hardcoded token. The runtime instructions therefore omit a critical step (authentication) and give the agent no guidance about credential handling.
Install Mechanism
There is no install spec (instruction-only), which minimizes disk install risk. However the code depends on the third-party Python package 'tushare' but does not declare that dependency in the manifest or SKILL.md, so runtime failures are possible if the environment lacks it.
Credentials
The skill requests no environment variables in metadata, yet includes a hardcoded secret token in source code. This leaks an access credential (the embedded Tushare token) and prevents the user from supplying their own token — both are disproportionate and insecure.
Persistence & Privilege
The skill does not request persistent/always-on privileges and does not modify system or other skill configurations. Autonomous invocation defaults are normal and not by themselves concerning here.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install tushare-stock-data - After installation, invoke the skill by name or use
/tushare-stock-data - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
- No visible changes in this version; documentation remains the same and no file changes detected.
v1.0.0
首次发布tushare股票数据源技能
Metadata
Frequently Asked Questions
What is tushare股票数据源?
提供基于股票代码从Tushare获取A股股票基础数据，支持自定义返回条数。 It is an AI Agent Skill for Claude Code / OpenClaw, with 318 downloads so far.
How do I install tushare股票数据源?
Run "/install tushare-stock-data" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is tushare股票数据源 free?
Yes, tushare股票数据源 is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does tushare股票数据源 support?
tushare股票数据源 is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created tushare股票数据源?
It is built and maintained by ghjkkkkkklkk (@ghjkkkkkklkk); the current version is v1.0.1.
More Skills