← 返回 Skills 市场
tushare股票数据源
作者
ghjkkkkkklkk
· GitHub ↗
· v1.0.1
· MIT-0
318
总下载
0
收藏
0
当前安装
2
版本数
在 OpenClaw 中安装
/install tushare-stock-data
功能描述
提供基于股票代码从Tushare获取A股股票基础数据，支持自定义返回条数。
安全使用建议
Do not install or run this skill as-is. The included Python file contains a hardcoded Tushare API token — using the skill will expose that token and use someone else's credentials for API calls. Ask the author to remove the embedded token and instead declare a required TUSHARE_TOKEN environment variable (document it in SKILL.md). If this token belongs to you, rotate/revoke it immediately and replace it with a personal token supplied via a secure env var. Also request that the skill manifest declare its dependency on the 'tushare' Python package so you can install it deliberately. If you must test, run it in an isolated environment and avoid using production credentials.
功能分析
Type: OpenClaw Skill
Name: tushare-stock-data
Version: 1.0.1
The skill contains a hardcoded Tushare API token in main.py (885cd28a17a52b35e5da6abb8ac11e20e85483affa4c4de8a9e6a928). While the code appears to function as described to fetch stock data, hardcoding credentials is a significant security vulnerability and a leaked secret, which warrants a suspicious classification despite the lack of other malicious indicators.
能力评估
Purpose & Capability
The skill's purpose (querying Tushare for A-share basic data) matches what the code does, but the manifest declares no required credentials while the code unconditionally sets a Tushare token. A properly designed skill would ask the user to provide their own TUSHARE token via an environment variable or configuration rather than embedding one.
Instruction Scope
SKILL.md describes inputs/outputs and does not mention authentication or a token, yet main.py sets and uses a hardcoded token. The runtime instructions therefore omit a critical step (authentication) and give the agent no guidance about credential handling.
Install Mechanism
There is no install spec (instruction-only), which minimizes disk install risk. However the code depends on the third-party Python package 'tushare' but does not declare that dependency in the manifest or SKILL.md, so runtime failures are possible if the environment lacks it.
Credentials
The skill requests no environment variables in metadata, yet includes a hardcoded secret token in source code. This leaks an access credential (the embedded Tushare token) and prevents the user from supplying their own token — both are disproportionate and insecure.
Persistence & Privilege
The skill does not request persistent/always-on privileges and does not modify system or other skill configurations. Autonomous invocation defaults are normal and not by themselves concerning here.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install tushare-stock-data - 安装完成后，直接呼叫该 Skill 的名称或使用
/tushare-stock-data触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.1
- No visible changes in this version; documentation remains the same and no file changes detected.
v1.0.0
首次发布tushare股票数据源技能
元数据
常见问题
tushare股票数据源 是什么？
提供基于股票代码从Tushare获取A股股票基础数据，支持自定义返回条数。 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 318 次。
如何安装 tushare股票数据源？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install tushare-stock-data」即可一键安装，无需额外配置。
tushare股票数据源 是免费的吗？
是的，tushare股票数据源 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
tushare股票数据源 支持哪些平台？
tushare股票数据源 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 tushare股票数据源？
由 ghjkkkkkklkk（@ghjkkkkkklkk）开发并维护，当前版本 v1.0.1。
推荐 Skills