A Stock Daily Market Sense，用于基于 Tushare Pro A 股 daily 日线数据生成盘后市场研报。当用户要求每日盘面感知、盘后复盘、赚钱效应在哪里、上涨主线是什么、主线 vs 资金轮动、爆量下跌、低位放量异动、指数背离个股、该弱不弱就是强、历史某日复盘，或基于 daily/da...
Security Analysis
medium confidenceThe skill mostly does what it says (builds a Tushare-based daily evidence pack) but the package metadata and instructions disagree about required secrets and dependencies, which is an incoherence you should understand before installing.
Name, description, SKILL.md, template, and scripts/market_panel.py all align: the skill fetches Tushare A-share daily data, computes volume/price features, and produces a market evidence pack used to render the six-section report. The code and template are consistent with the declared purpose.
SKILL.md instructs running scripts/market_panel.py to fetch Tushare data and build candidate pools; the script reads TUSHARE_TOKEN from the environment or a cwd .env file. The runtime instructions do not instruct reading unrelated system files or contacting unexpected third-party endpoints beyond Tushare. Note: the SKILL.md explicitly allows reading a .env file in the working directory, which can expose any secrets stored there.
This is an instruction-only skill with no install spec; there is no package download or privileged installer. That minimizes install-time risk. However, the Python script requires runtime dependencies (pandas, tushare) which are not declared in registry metadata.
Registry metadata lists no required env vars, but both SKILL.md and the script require a TUSHARE_TOKEN (read from environment or cwd/.env). Dependencies (pandas, tushare) are required at runtime but not declared. Asking for a single Tushare API token is appropriate for this purpose, but the metadata omission and .env file access are inconsistent and worth noting.
always is false and the skill does not request persistent system-wide privileges. The script reads cwd/.env and environment variables and makes network calls to Tushare (expected). It does not declare modifying other skills or agent config. Autonomous invocation is allowed by default but not combined with other high-risk flags.
Guidance
This skill appears to do what it claims: it fetches A-share daily data from Tushare and builds the numeric evidence the report uses. Before installing, note these points: (1) You must provide a TUSHARE_TOKEN (either as an environment variable or in a .env file in the skill's working directory); the registry metadata did not declare this — verify you are comfortable exposing that token to the agent and store a token with minimal privileges if possible. (2) The Python script requires pandas and tushare at runtime but the skill metadata doesn't list dependencies — install them in a controlled virtualenv/sandbox. (3) The script reads cwd/.env; avoid putting any unrelated secrets in that file or run the skill in an isolated folder. (4) The script makes network calls to Tushare (expected). If you need extra assurance, inspect the full scripts/market_panel.py (we reviewed the visible portions) or run it in an isolated environment to confirm it only contacts Tushare and does not write unexpected files or contact 3rd-party endpoints. If you cannot verify these things, treat the metadata mismatch as a red flag and consider running it manually rather than enabling autonomous invocation.
Latest Release
v1.6.2
Rename skill from tushare-daily-market-sense to a-stock-daily-market-sense and compact SKILL.md for ClawHub publishing.
Popular Skills
Published by @chinfi-codex on ClawHub
