The Agent Skills Directory

[SAFE]: The skill implements a robust financial data research tool using the official Tushare Python library. All scripts and instructions are consistent with the stated purpose of data retrieval and analysis.
[CREDENTIALS_SAFE]: The skill correctly manages sensitive credentials by utilizing environment variables (TUSHARE_TOKEN) for API authentication. No hardcoded secrets or sensitive keys were found in the skill files.
[INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface because it ingests untrusted external data from financial news, corporate announcements, and research reports (e.g., via news and anns_d interfaces).
Ingestion points: External text data is retrieved from Tushare API endpoints including news, major_news, anns_d, and research_report.
Boundary markers: The instructions do not explicitly define boundary markers or delimiters to isolate untrusted external content from the agent's core instructions.
Capability inventory: Analysis of scripts/fund_data_demo.py and scripts/stock_data_demo.py confirms that the skill lacks dangerous capabilities such as shell command execution (subprocess, os.system), file system modifications, or arbitrary code evaluation (eval, exec).
Sanitization: There is no explicit sanitization of the fetched text data; however, because the skill has no dangerous execution capabilities, the risk of exploitation is negligible.
[EXTERNAL_DOWNLOADS]: All external references and documentation links point to the official tushare.pro domain. These are used for legitimate documentation and are provided by the skill author.

tushare