tushare-base

Fetch Chinese stock and futures market data via Tushare API. Supports stock quotes, futures data, company fundamentals, and macroeconomic indicators. Use when the user needs financial data from Chinese markets. Requires TUSHARE_TOKEN environment variable.

This skill appears to implement exactly what it claims (fetching Chinese market data via Tushare) and the included script looks benign, but the registry metadata omission is a red flag. Before installing or running it: (1) Confirm the publisher/source — no homepage is provided. (2) Don't paste your TUSHARE_TOKEN into shared or public files; prefer exporting it in a shell session or use a secrets manager rather than committing it to dotfiles. (3) Review scripts/market.py yourself (you have the file) to ensure no hidden endpoints or logging of secrets; the visible code only calls the tushare library. (4) Install dependencies in a virtualenv or sandbox (pip3 install --user or venv) to limit impact. (5) Ask the publisher/registry owner to update the metadata to declare TUSHARE_TOKEN as a required credential so automated checks and users are not misled.

Type: OpenClaw Skill Name: tushare-base Version: 1.0.0 The skill bundle is benign. It provides a legitimate interface to the Tushare financial data API. The `SKILL.md` clearly documents the skill's purpose, prerequisites (including the `TUSHARE_TOKEN` environment variable), and usage examples. The `scripts/market.py` script correctly utilizes `os.getenv` to retrieve the API token and interacts solely with the `tushare` library to fetch and display financial data. There is no evidence of data exfiltration, malicious execution, persistence, prompt injection against the agent, or obfuscation. All actions are aligned with the stated purpose of fetching financial market data.