Skills
Navigate
skills/yrzhe/claude-skills/akshare-a-shares/Gen Agent Trust Hub

akshare-a-shares

Fail

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill uses eval() on strings fetched from remote URLs in akshare/fund/fund_etf_sina.py and akshare/fund/fund_fhsp_em.py, allowing for arbitrary code execution if the remote source is compromised.
  • [EXTERNAL_DOWNLOADS]: The file akshare/futures/cons.py includes a reference to a blacklisted URL (http://www.super-ping.com) within its HTTP request headers.
  • [COMMAND_EXECUTION]: The skill executes external JavaScript files (jm.js, crypto.js, outcrypto.js) using py_mini_racer. These scripts contain complex logic and significant obfuscation in the case of jm.js.
  • [REMOTE_CODE_EXECUTION]: The file akshare/futures/cons.py performs unsafe deserialization using pickle.load() on local data files, which can lead to code execution.
  • [DATA_EXFILTRATION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data from multiple external financial APIs without boundary markers or sanitization, as seen in akshare/air/air_zhenqi.py and other data-fetching modules.
Recommendations
  • AI detected serious security threats
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 27, 2026, 07:11 AM
Security Audit — agent-trust-hub — akshare-a-shares