data-cn
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
pack.pyscript serves as a facade to orchestrate multiple internal client scripts. It usessubprocess.run()to executeyfinance_client.py,nbs_client.py,akshare_client.py, andfred_client.py. The implementation is secure as it passes arguments as a list (avoiding shell interpolation) and performs ticker normalization to ensure inputs match expected patterns. - [EXTERNAL_DOWNLOADS]: The skill connects to several well-known and legitimate financial data providers. This includes the National Bureau of Statistics of China (NBS) via their
data.stats.gov.cnAPI, the St. Louis Federal Reserve (FRED) via CSV downloads, and Yahoo Finance via theyfinancelibrary. These connections are consistent with the skill's stated purpose of financial data analysis. - [SAFE]: No malicious patterns such as credential exfiltration, persistence, or obfuscation were detected. The skill uses environment variables for cache management (
INVESTING_TOOLKIT_CACHE) and implements robust data sanitization by casting retrieved values into float types before outputting them as structured JSON.
Audit Metadata