Skills
Navigate
skills/zhuxining/stk-cli/mx-stocks-screener/Gen Agent Trust Hub

mx-stocks-screener

Fail

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The script scripts/get_data.py contains a hardcoded API key em_fjFqd4YB6Cqs52LF48XWbMDdLNq6MyNg as a default value for the EM_API_KEY environment variable. Hardcoding credentials in source code is an unsafe practice that exposes the secret to anyone with access to the skill files.
  • [DATA_EXFILTRATION]: The skill transmits user-provided search queries and generated metadata (such as call and user IDs) to ai-saas.eastmoney.com. This network activity is necessary for the skill's primary function of fetching financial data from the service provider.
  • [COMMAND_EXECUTION]: The SKILL.md file provides instructions for executing the Python script via the command line with user-controlled input (--query). While this is the intended usage, it involves direct shell interaction with user-supplied arguments.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 15, 2026, 01:47 AM
Security Audit — agent-trust-hub — mx-stocks-screener