a-stock-data
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous Python code blocks designed to be executed by the agent. These scripts manage data retrieval from various financial APIs, perform valuation calculations (PE, PEG, etc.), and handle the downloading and saving of PDF research reports.
- [EXTERNAL_DOWNLOADS]: The skill requires several standard Python packages (
mootdx,akshare,requests,pandas) to be installed viapip. It also facilitates the download of PDF research reports from Eastmoney's servers (pdf.dfcfw.com) and fetches data from multiple external financial service domains. - [DATA_EXFILTRATION]: The skill initiates network requests to several external endpoints including Tencent Finance (
qt.gtimg.cn), Eastmoney (reportapi.eastmoney.com), iWencai (openapi.iwencai.com), and Tonghuashun (zx.10jqka.com.cn,data.hexin.cn). These requests are used solely to transmit stock identifiers or search queries and receive financial data. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external financial APIs. While this creates a theoretical attack surface for indirect prompt injection if an external source were to provide malicious content, the risk is categorized as low given the structured nature of the financial data being processed.
- Ingestion points: Data enters the agent's context through HTTP responses from several third-party financial data providers.
- Boundary markers: Not explicitly defined within the data-fetching scripts.
- Capability inventory: The skill possesses network fetch capabilities via
requests/urlliband file-write capabilities for saving PDF reports. - Sanitization: The skill employs basic sanitization, such as using regular expressions to clean filenames before saving PDF downloads.
Audit Metadata