ashare-news-fetcher
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing several Python packages including requests, beautifulsoup4, akshare, and jieba. These are widely used and reputable libraries within the Chinese financial analysis ecosystem for network requests and text processing.
- [INDIRECT_PROMPT_INJECTION]: The skill aggregates data from external sources such as financial news sites and social media platforms, creating an attack surface for indirect prompt injection if the fetched content contains malicious instructions for the downstream agent.
- Ingestion points: The script fetch_intel.py retrieves news and sentiment data from multiple domains including cls.cn, wallstcn.com, jin10.com, sina.com.cn, eastmoney.com, and several government agency portals (csrc.gov.cn, pbc.gov.cn, sse.com.cn, mof.gov.cn).
- Boundary markers: The fetched data is organized into structured JSON or Markdown items, which provides clear separation between individual reports for the agent.
- Capability inventory: The skill performs network operations to fetch data and uses regular expressions and local logic for stock code extraction and sentiment scoring.
- Sanitization: The script implements a _strip_html function that removes HTML tags and decodes entities from the fetched content before it is passed to the agent context.
Audit Metadata