tushare
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
market_data.py,financial_data.py, etc.) to process data requests. These scripts use theargparselibrary to handle user-provided inputs such as stock codes and date ranges, which is a standard and safe method for parameterizing script execution. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the external Tushare API, creating a surface where untrusted data enters the agent context. However, the risk is mitigated as the skill's capabilities are limited to data retrieval and JSON display, without providing high-risk tools like arbitrary file writing or secondary command execution based on the ingested data.
- Ingestion points: Tushare API responses processed in
scripts/market_data.py,scripts/financial_data.py,scripts/stock_info.py, andscripts/macro_index_data.py. - Boundary markers: None explicitly implemented in the scripts.
- Capability inventory: Data retrieval via the
tusharelibrary and printing formatted results to standard output. - Sanitization: The scripts transform data from library-specific objects into JSON format for display but do not perform explicit content filtering.
Audit Metadata