china-stock-data
Fail
Audited by Gen Agent Trust Hub on Jul 19, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill includes hardcoded authentication credentials for external financial data services.
- Evidence: SKILL.md and references/jqdata-trial-session.md provide a specific phone number and password for the JQData service ('13986187760', 'Yu123(j)').
- Evidence: references/quant-platforms-comparison.md includes a plaintext Tushare Pro token ('be048ffb8d6a29f64139a9da1f88fbd31783ccf4cc10582ce58ad5e1').
- [COMMAND_EXECUTION]: The skill's workflow involves executing commands and transferring files to an untrusted remote server.
- Evidence: references/daily-report-workflow.md describes a process involving 'ssh root@45.76.185.1' and 'scp' to perform tasks on an external VPS.
- [EXTERNAL_DOWNLOADS]: The skill requires downloading several external Python libraries and fetches data from numerous third-party financial APIs.
- Evidence: SKILL.md provides setup instructions for installing packages like 'pytdx', 'akshare', and 'jqdatasdk' via pip.
- Evidence: Multiple scripts are designed to fetch data from external domains including 'qt.gtimg.cn' and 'api.tushare.pro'.
- [DATA_EXFILTRATION]: The instruction to move data to a remote VPS creates a risk of sensitive information being transferred out of the secure environment.
- Evidence: The 'market_daily_report.py' workflow sends local data to a remote server at 45.76.185.1 for processing.
Recommendations
- AI detected serious security threats
Audit Metadata